CVE-2024-45604

Executive Summary

CVE-2024-45604 is a Path Traversal vulnerability in the Contao Open Source CMS. Authenticated back-end users can exploit the file selector widget to list files outside the document root. This allows an attacker to enumerate the server's directory structure and potentially discover sensitive files. The vulnerability has a CVSS score of 4.3 (Medium) and is patched in Contao version 4.13.49. No public proof-of-concept code or exploit templates are currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core CMS vulnerability in the Contao PHP application.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated back-end user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): Low (limited file listing)
• Integrity (I): None
• Availability (A): None

The threat level is considered Medium due to the requirement for authentication and the limited impact (only file listing, not modification or execution).

Deep Dive & Mechanics

The vulnerability resides in the file selector widget used in the Contao back end. This widget is designed to allow users to browse and select files from the document root. However, due to insufficient input validation and path sanitization, an authenticated attacker can manipulate the widget's parameters to traverse directories outside the intended root.

Root Cause: The application fails to properly validate or sanitize user-supplied paths, allowing directory traversal sequences (e.g., ../) to escape the document root.

Attack Flow:

1. An attacker authenticates to the Contao back end.
2. The attacker accesses a page or module that uses the file selector widget.
3. The attacker intercepts the request (e.g., via browser developer tools or a proxy) and modifies the path parameter to include traversal sequences (e.g., ../../etc/).
4. The server processes the request and returns a listing of files in the traversed directory.
5. The attacker can enumerate the file system structure and potentially discover sensitive configuration files, logs, or other data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user input without sanitization
$path = $_GET['path'];
$files = scandir($path);

Patched Code (Conceptual):

// Patched: Validates and restricts path to document root
$path = $_GET['path'];
$basePath = realpath($documentRoot);
$fullPath = realpath($basePath . '/' . $path);
if (strpos($fullPath, $basePath) !== 0) {
    die('Invalid path');
}
$files = scandir($fullPath);

The patched version uses realpath() to resolve the full path and then checks that it starts with the document root, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Contao back-end account with any role.
• A Contao instance running version < 4.13.49.

Exploitation Steps:

1. Log in to the Contao back end.
2. Navigate to a page that uses the file selector widget (e.g., when editing an article or adding a file link).
3. Open the browser's developer tools (Network tab) or use a proxy like Burp Suite.
4. Intercept the request to the file selector endpoint (e.g., contao/file-selector).
5. Modify the path parameter to include traversal sequences. For example:
   • path=../../../etc/ to list the /etc directory.
   • path=../../../var/log/ to list log files.
6. Forward the request and observe the response, which will contain a directory listing of the traversed path.

Example Request:

POST /contao/file-selector HTTP/1.1
Host: target.com
Cookie: contao_backend_session=...
Content-Type: application/x-www-form-urlencoded

path=../../../etc/&action=list

Expected Response:

{
  "files": [
    "passwd",
    "shadow",
    "hosts",
    ...
  ]
}

Blue Team

Detection:

• Monitor for unusual path traversal patterns in file selector requests.
• Look for requests containing ../ sequences in the path parameter.
• Alert on multiple failed attempts to access non-standard directories.

Hunting:

• Search web server logs for requests to /contao/file-selector with path parameters containing ../.
• Correlate with back-end user activity logs to identify the attacker's account.

Containment:

• Immediately apply the patch by updating to Contao 4.13.49.
• If patching is not possible, restrict access to the file selector widget by disabling it for non-admin users.
• Review and rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /contao/file-selector with path parameters containing ../.
  • Unusual directory listing responses from the file selector endpoint.
• File System IOCs:
  • Access logs showing traversal attempts to /etc/passwd, /var/log, etc.
• User Behavior IOCs:
  • Back-end user accounts making repeated requests to the file selector with non-standard paths.

Detection Engineering

YARA Rule

rule CVE_2024_45604_Contao_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Contao file selector requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45604"
    strings:
        $traversal = /\.\.\//
        $endpoint = "contao/file-selector"
    condition:
        $endpoint and #traversal > 0
}

Sigma Rule

title: Contao File Selector Path Traversal
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects path traversal attempts in Contao CMS file selector widget
author: Valters IT
date: 2024-10-27
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45604
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'contao/file-selector'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45604 Contao File Selector Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"contao/file-selector"; http_uri; content:"../"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Contao to version 4.13.49 or later. This is the only official fix.
2. Workaround: If patching is not immediately possible, restrict access to the file selector widget by modifying user permissions. Only allow trusted administrators to use this feature.

Long-Term Measures:

• Implement input validation and sanitization for all user-supplied paths.
• Use a whitelist of allowed directories for file browsing.
• Regularly update Contao and all dependencies.
• Monitor web server logs for path traversal attempts.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.