CVE-2024-48225

Executive Summary

CVE-2024-48225 identifies an arbitrary file deletion vulnerability in Funadmin v5.0.2, specifically within the /curd/index/delfile endpoint. This flaw allows an authenticated attacker to delete arbitrary files on the server, potentially leading to denial of service, data loss, or privilege escalation by removing critical system or application files. The vulnerability is unpatched as of the latest advisory, and no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential impact.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct issue within the Funadmin PHP application.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – authentication is required.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerability does not affect other components.
• Confidentiality (C): None (N) – file deletion does not directly leak data.
• Integrity (I): High (H) – arbitrary file deletion compromises system integrity.
• Availability (A): High (H) – deletion of critical files can cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Estimated Base Score: 8.1 (High)

Threat Level: High. While exploitation requires authentication, the impact on integrity and availability is severe.

Deep Dive & Mechanics

The vulnerability resides in the delfile action of the curd controller. The application fails to properly sanitize or validate the file path parameter before passing it to a file deletion function (e.g., unlink() in PHP). An attacker can supply a path traversal sequence (e.g., ../../../etc/passwd) to delete files outside the intended directory.

Root Cause: Lack of input validation and path sanitization. The application likely uses user-supplied input directly in file operations without checking for directory traversal characters or restricting the deletion to a specific directory.

Attack Flow:

1. Attacker authenticates to Funadmin.
2. Attacker sends a POST request to /curd/index/delfile with a crafted file parameter containing path traversal sequences.
3. The application deletes the specified file without verifying the path is within allowed boundaries.
4. The attacker can delete configuration files, application code, or system files, leading to various impacts.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (PHP):

public function delfile() {
    $file = $_POST['file'];
    if (file_exists($file)) {
        unlink($file);
        echo "File deleted.";
    } else {
        echo "File not found.";
    }
}

Patched Code (Conceptual):

public function delfile() {
    $file = basename($_POST['file']); // Remove path components
    $allowed_dir = '/var/www/funadmin/uploads/';
    $full_path = $allowed_dir . $file;
    if (file_exists($full_path) && strpos(realpath($full_path), realpath($allowed_dir)) === 0) {
        unlink($full_path);
        echo "File deleted.";
    } else {
        echo "Invalid file.";
    }
}

The patched version uses basename() to strip directory components and verifies the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for Funadmin.
• Network access to the Funadmin instance.

Exploit Steps:

1. Log in to Funadmin.
2. Craft a POST request to /curd/index/delfile with the following body:

   file=../../../etc/passwd
   

3. Send the request using a tool like curl:

   curl -X POST -d "file=../../../etc/passwd" -b "session=your_session_cookie" http://target.com/curd/index/delfile
   

4. Verify deletion by attempting to read the file or observing system behavior.

Expected Outcome: The /etc/passwd file is deleted, causing authentication issues on the server.

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /curd/index/delfile with suspicious file parameters containing ../ or absolute paths.
• Alert on file deletion events outside the application's upload directory.
• Use file integrity monitoring (FIM) to detect unexpected deletions.

Response:

• Immediately isolate the affected server.
• Restore deleted files from backups.
• Review access logs for the attacker's session.
• Apply a virtual patch (e.g., WAF rule blocking path traversal patterns).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /curd/index/delfile with file parameter containing ../ or / characters.
  • Unusual HTTP 200 responses from the endpoint with "File deleted" message.
• File System:
  • Missing critical files (e.g., /etc/passwd, /var/www/funadmin/config.php).
  • Unexpected file deletions in system directories.
• Logs:
  • Web server logs showing POST /curd/index/delfile with suspicious parameters.
  • PHP error logs indicating unlink() failures or warnings.

Detection Engineering

YARA Rule

rule CVE_2024_48225_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2024-48225 arbitrary file deletion in Funadmin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48225"
    strings:
        $s1 = "/curd/index/delfile" ascii wide nocase
        $s2 = "file=" ascii wide nocase
        $s3 = "../" ascii wide
        $s4 = "unlink(" ascii wide
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: CVE-2024-48225 Funadmin Arbitrary File Deletion
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to /curd/index/delfile with path traversal patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/curd/index/delfile'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|contains: 'file=uploads/'
    condition: selection and not filter
falsepositives:
    - Legitimate file deletion within allowed directory
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48225 Funadmin Arbitrary File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/curd/index/delfile"; http_uri; content:"file="; http_client_body; pcre:"/file=[^&]*\.\.\//"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If not required, block access to /curd/index/delfile via web server configuration or WAF.
2. Apply virtual patch: Use a WAF to block requests containing ../ or absolute paths in the file parameter.
3. Restrict file permissions: Ensure the web server runs with minimal privileges to limit the impact of file deletion.

Long-term Fix:

• The vendor should release a patch that implements proper input validation, path sanitization, and directory restriction.
• Until a patch is available, consider migrating to an alternative solution or implementing a custom fix as shown in the patched code example.

Monitoring:

• Enable detailed logging for the /curd/index/delfile endpoint.
• Implement file integrity monitoring for critical system and application files.

Valters IT
DevSecOps & Cyber Threat Intelligence