CVE-2024-45842

Executive Summary

CVE-2024-45842 is a path traversal vulnerability affecting Sharp and Toshiba Tec Multifunction Peripherals (MFPs). The flaw resides in the improper processing of URI data within HTTP PUT requests. An unauthenticated, remote attacker can craft a malicious HTTP PUT request containing path traversal sequences (e.g., ../) to read unintended internal files from the device's filesystem. This could expose sensitive configuration files, credentials, or other operational data. The CVSS score is 5.3 (Medium), with a low attack complexity and no user interaction required. No public proof-of-concept (PoC) or exploit code has been released at this time, and the vendor patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited file read access is possible.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the impact is limited to low confidentiality, the ease of exploitation and lack of authentication make it a viable target for information gathering in network reconnaissance.

Deep Dive & Mechanics

The vulnerability exists in the HTTP PUT request handler of Sharp and Toshiba Tec MFPs. These devices expose a web interface for management and file operations. The PUT method is typically used to upload files (e.g., scanned documents, firmware updates). However, due to insufficient validation of the URI path, an attacker can inject path traversal sequences such as ../ to escape the intended upload directory.

Technical Flow:

1. The attacker sends an HTTP PUT request to the MFP's web server.
2. The URI contains a path like /../../../etc/passwd.
3. The server fails to sanitize or canonicalize the path, allowing the traversal.
4. The server reads the requested file from the filesystem and returns its contents in the HTTP response body.

Root Cause: The application does not properly validate or normalize the URI path before using it in file system operations. This is a classic CWE-22 (Path Traversal) flaw.

Affected Components:

• Sharp MFPs with web interface enabled.
• Toshiba Tec MFPs with web interface enabled.

Potential Exposed Files:

• /etc/passwd (user account information)
• Configuration files (e.g., config.xml, settings.conf)
• Credential files (e.g., passwd, shadow if accessible)
• Log files containing sensitive data

Vulnerable vs. Patched Code

Since no official patch or source code is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

# Vulnerable handler
def handle_put_request(request):
    file_path = request.uri  # No sanitization
    with open(file_path, 'rb') as f:
        data = f.read()
    return data

Patched Code (Conceptual):

import os

def handle_put_request(request):
    base_dir = "/var/mfp/uploads"
    # Sanitize and canonicalize the path
    requested_path = os.path.normpath(request.uri)
    # Ensure the resolved path is within the base directory
    if not requested_path.startswith(base_dir):
        return "Access Denied", 403
    with open(requested_path, 'rb') as f:
        data = f.read()
    return data

The patched version uses os.path.normpath() to resolve path traversal sequences and then checks that the resulting path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive):

Since no public exploit code is available, the following is a conceptual approach.

1. Identify Target: Use Shodan dorks to find exposed Sharp or Toshiba Tec MFPs.
2. Craft Request: Use curl to send a malicious PUT request.

   curl -X PUT "http://target-ip/../../../etc/passwd" -H "Host: target-ip"
   

3. Read Response: The server may return the contents of /etc/passwd or an error if the file does not exist.
4. Enumerate Files: Try common paths like:
   • /../../../etc/shadow
   • /../../../etc/config.xml
   • /../../../var/log/syslog

Blue Team (Defensive):

1. Network Monitoring: Detect anomalous HTTP PUT requests with path traversal patterns.
2. Web Application Firewall (WAF): Block requests containing ../ or ..\\ in the URI.
3. Access Control: Restrict network access to MFP web interfaces to trusted IPs only.
4. File System Permissions: Ensure the web server runs with minimal privileges and cannot read sensitive system files.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP PUT requests with URIs containing ../ or ..\\ sequences.
  • Unusual HTTP response sizes (e.g., returning /etc/passwd which is typically 1-2 KB).
  • Requests to paths like /../../../etc/passwd, /../../../etc/shadow, /../../../etc/config.xml.

• Host IOCs:

  • Unauthorized file read attempts logged in the MFP's access logs.
  • Presence of unexpected files in the upload directory (if the PUT method is used for writing).

• File IOCs:

  • /etc/passwd or /etc/shadow being accessed via the web interface.

Detection Engineering

YARA Rule:

rule CVE_2024_45842_Sharp_Toshiba_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP PUT requests targeting Sharp/Toshiba MFPs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45842"
    strings:
        $put_method = "PUT" ascii wide nocase
        $path_traversal = ".." ascii wide
        $mfp_signature = "Sharp" ascii wide nocase or "Toshiba" ascii wide nocase
    condition:
        $put_method and $path_traversal and $mfp_signature
}

Sigma Rule:

title: CVE-2024-45842 Path Traversal in HTTP PUT Requests
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP PUT requests with path traversal sequences targeting Sharp/Toshiba MFPs
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate file uploads with '..' in filename (rare)
level: high

Suricata Rule:

alert http any any -> any any (msg:"CVE-2024-45842 Path Traversal in HTTP PUT Request"; flow:to_server; http.method; content:"PUT"; http.uri; content:".."; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTTP PUT Method: If not required, disable the PUT method on the MFP's web server.
2. Network Segmentation: Place MFPs on a separate VLAN with strict firewall rules limiting access to management interfaces.
3. WAF Rules: Deploy a Web Application Firewall to block path traversal patterns in URIs.

Long-Term Fixes:

1. Vendor Patch: Await an official firmware update from Sharp or Toshiba Tec that properly sanitizes URI paths.
2. Input Validation: Implement server-side validation to canonicalize paths and reject traversal sequences.
3. Least Privilege: Run the web server with minimal file system permissions.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to filter and sanitize incoming PUT requests before they reach the MFP.
• Monitor logs for suspicious PUT requests and alert on anomalies.

Valters IT