CVE-2024-50625

Executive Summary

CVE-2024-50625 is a critical vulnerability in Digi ConnectPort LTS devices prior to version 1.4.12. The flaw resides in the file upload handling mechanism of the web application, allowing an attacker to manipulate file paths via POST requests. This enables arbitrary file uploads within specific directories, which can be leveraged for privilege escalation when combined with other vulnerabilities. The vulnerability has a CVSS score of 0.0 (unscored) but poses a significant risk to operational technology (OT) environments. No public exploit code or proof-of-concept is currently available, but the attack surface is exposed via Shodan.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware on Digi ConnectPort LTS devices, which are part of the industrial IoT supply chain. Organizations should verify the integrity of firmware updates from Digi’s official channels.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating that the NVD has not yet assigned a score. Based on the description, the vector would likely be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The ability to upload arbitrary files without authentication can lead to full device compromise.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of the Digi ConnectPort LTS web interface. The application fails to properly sanitize user-supplied file paths in POST requests. An attacker can craft a request with a path traversal payload (e.g., ../../etc/passwd) to write files outside the intended upload directory. This allows the upload of malicious scripts or configuration files that can be executed by the device, leading to privilege escalation.

Root Cause: Insufficient validation of the filename parameter in the multipart form data.

Attack Flow:

1. Attacker identifies a Digi ConnectPort LTS device exposed to the internet.
2. Attacker sends a crafted POST request to the file upload endpoint with a manipulated file path.
3. The device writes the uploaded file to an arbitrary directory (e.g., /www/ or /etc/).
4. If the file is a script (e.g., PHP, shell script), the attacker can execute it via the web server or cron job.
5. Combined with other vulnerabilities (e.g., command injection), the attacker escalates to root.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.4.12):

# Example of vulnerable file upload handler
def handle_upload(request):
    filename = request.POST['filename']
    # No path sanitization
    with open('/uploads/' + filename, 'wb') as f:
        f.write(request.FILES['file'].read())

Patched Code (1.4.12):

# Example of patched file upload handler
import os
def handle_upload(request):
    filename = os.path.basename(request.POST['filename'])
    # Restrict to allowed directory
    upload_dir = '/uploads/'
    filepath = os.path.join(upload_dir, filename)
    if not filepath.startswith(upload_dir):
        raise Exception("Invalid path")
    with open(filepath, 'wb') as f:
        f.write(request.FILES['file'].read())

Exploitation & Lab Setup

Red Team

Prerequisites:

• Digi ConnectPort LTS device with firmware < 1.4.12
• Network access to the web interface (port 80/443)

Exploitation Steps:

1. Identify the upload endpoint (e.g., /upload).
2. Craft a POST request with a path traversal payload:

curl -X POST http://target/upload \
  -F "file=@malicious.php" \
  -F "filename=../../www/malicious.php"

3. Access the uploaded file via the web server:

curl http://target/malicious.php

4. Execute commands to escalate privileges (e.g., add SSH key).

Note: No public exploit code is available. This is a theoretical exploitation based on the vulnerability description.

Blue Team

Detection:

• Monitor for POST requests to file upload endpoints with suspicious filename parameters containing ../ or ..\\.
• Alert on file writes to unexpected directories (e.g., /www/, /etc/, /tmp/).

Hunting:

• Search logs for HTTP 200 responses to upload endpoints followed by access to new files.
• Use file integrity monitoring (FIM) to detect unauthorized file creation.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /upload with filename containing ../
  • Outbound connections from the device to unknown IPs after file upload
• File System:
  • Unexpected files in /www/, /etc/, or /tmp/ directories
  • Files with extensions .php, .sh, .py in non-standard locations
• Process:
  • Unusual processes spawned by the web server (e.g., /bin/sh)

Detection Engineering

YARA Rule

rule CVE_2024_50625_FileUpload {
    meta:
        description = "Detects path traversal in file upload requests to Digi ConnectPort LTS"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2024-50625"
    strings:
        $path_traversal = /filename=[^&]*\.\.\//
    condition:
        $path_traversal
}

Sigma Rule

title: CVE-2024-50625 File Upload Path Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in file uploads to Digi ConnectPort LTS
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-uri-query|contains: 'filename='
        cs-uri-query|re: '\.\.\/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50625 File Upload Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename"; http_client_body; pcre:"/filename=[^&]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Digi ConnectPort LTS firmware to version 1.4.12 or later.
2. Restrict network access to the web interface using firewall rules (allow only trusted IPs).
3. Disable file upload functionality if not required.

Long-term Measures:

• Implement input validation and path sanitization in all file upload handlers.
• Use a web application firewall (WAF) to block path traversal patterns.
• Conduct regular security audits of OT devices.

Workaround:

• If patching is not possible, place the device behind a VPN and disable remote management.

Valters IT
DevSecOps & Cyber Threat Intelligence