CVE-2024-54938

Executive Summary

CVE-2024-54938 is a directory listing vulnerability in Kashipara E-Learning Management System v1.0. The vulnerability allows remote, unauthenticated attackers to enumerate and access sensitive files and directories located under /admin/uploads/. This exposure can lead to information disclosure, including configuration files, user-uploaded content, and potentially credentials or other sensitive data. The vulnerability is trivial to exploit and requires no authentication, making it a high-priority finding for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application. However, the lack of a patch from the vendor (Kashipara) means that any organization using this software is at risk and must implement compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure (file listing).
• Integrity (I): None (N) - No data modification possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed files may contain sensitive data that could be used to pivot to more severe attacks.

Deep Dive & Mechanics

The vulnerability exists because the web server is configured to allow directory listing for the /admin/uploads/ path. When a user accesses http://target.com/admin/uploads/, the server returns a list of all files and subdirectories within that directory. This is a classic misconfiguration.

Root Cause: The web server (likely Apache or Nginx) does not have a directive to disable directory listing for the /admin/uploads/ directory. In Apache, this is controlled by the Options -Indexes directive. In Nginx, it is controlled by autoindex off;.

Attack Vector: An attacker sends a simple HTTP GET request to the vulnerable path.

Impact:

• Information Disclosure: Attackers can view all files uploaded by administrators or users, including:
  • Student submissions (assignments, exams).
  • Profile pictures.
  • Configuration files (e.g., .env, config.php).
  • Backup files.
  • Any other files stored in the uploads directory.
• Privilege Escalation: If configuration files containing database credentials or API keys are exposed, an attacker could gain access to the underlying database or other services.
• Data Breach: Exposure of personally identifiable information (PII) of students and staff.

Vulnerable vs. Patched Code

Vulnerable Configuration (Apache .htaccess or httpd.conf):

<Directory "/var/www/html/admin/uploads">
    Options +Indexes
</Directory>

Patched Configuration:

<Directory "/var/www/html/admin/uploads">
    Options -Indexes
</Directory>

Vulnerable Configuration (Nginx):

location /admin/uploads/ {
    autoindex on;
}

Patched Configuration (Nginx):

location /admin/uploads/ {
    autoindex off;
}

PHP Code (No patch available from vendor): The PHP application itself does not control directory listing; it is a server-level configuration. The vendor has not released a patch to address this.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Kashipara E-Learning Management System v1.0.
• Network access to the web server.

Steps:

1. Identify the target: http://target.com/
2. Access the vulnerable directory:

   curl http://target.com/admin/uploads/
   

3. Analyze the output: The server will return an HTML page listing all files and directories.
4. Download sensitive files:

   wget -r -np http://target.com/admin/uploads/
   

   This will recursively download all files in the directory.

Example Output:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /admin/uploads</title>
 </head>
 <body>
<h1>Index of /admin/uploads</h1>
<ul><li><a href="/"> Parent Directory</a></li>
<li><a href="config.php"> config.php</a></li>
<li><a href="student_submissions/"> student_submissions/</a></li>
<li><a href="profile_pics/"> profile_pics/</a></li>
</ul>
</body></html>

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /admin/uploads/ from unusual IP addresses.
• Look for patterns of recursive directory listing (e.g., wget -r).

Response:

1. Immediate: Disable directory listing on the web server (see Remediation).
2. Investigate: Check web server logs to determine if the vulnerability has been exploited.
3. Contain: If sensitive files were exposed, rotate any credentials found in those files (database passwords, API keys, etc.).
4. Eradicate: Remove any exposed files that should not be publicly accessible.
5. Recover: Restore any affected data from backups if necessary.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /admin/uploads/ with a User-Agent string indicating automated tools (e.g., curl, wget, python-requests).
  • Multiple sequential requests to /admin/uploads/ followed by requests to files within that directory.
• Host:
  • Web server access logs showing 200 OK responses for /admin/uploads/ with a large response body (indicating directory listing).
  • Unusual files in the /admin/uploads/ directory (e.g., .env, config.php backups).
• File:
  • Presence of files like config.php.bak, db_backup.sql, or .env in the /admin/uploads/ directory.

Detection Engineering

YARA Rule

rule Detect_Directory_Listing_Response {
    meta:
        description = "Detects HTTP responses indicating directory listing for /admin/uploads/"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-54938"
    strings:
        $index = "Index of /admin/uploads"
        $parent = "Parent Directory"
        $title = "<title>Index of /admin/uploads</title>"
    condition:
        any of them
}

Sigma Rule

title: Directory Listing Access to /admin/uploads/
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to the vulnerable /admin/uploads/ directory.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54938
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem:
            - '/admin/uploads/'
            - '/admin/uploads'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-54938 - Directory Listing Attempt on /admin/uploads/"; flow:to_server,established; content:"GET"; http_method; content:"/admin/uploads/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (Compensating Controls):

1. Disable Directory Listing:

   • Apache: Add Options -Indexes to the <Directory> block for /admin/uploads/ in your httpd.conf or .htaccess file.
   • Nginx: Set autoindex off; in the location /admin/uploads/ block.
   • IIS: Uncheck "Directory Browsing" in the IIS Manager for the admin/uploads folder.

2. Restrict Access:

   • Use .htaccess or Nginx allow/deny directives to restrict access to /admin/uploads/ to specific IP addresses (e.g., internal network or VPN).
   • Implement HTTP Basic Authentication for the /admin/uploads/ path.

3. Web Application Firewall (WAF):

   • Create a WAF rule to block requests to /admin/uploads/ that do not originate from trusted IPs.

Long-Term Remediation:

1. Vendor Patch: Contact Kashipara and request a security patch. If no patch is forthcoming, consider migrating to a different, actively maintained e-learning platform.
2. Code Review: If you have access to the source code, implement a custom file access control mechanism that prevents direct URL access to uploaded files. Serve files through a PHP script that checks permissions.
3. File Storage: Move uploaded files outside of the web root (e.g., to /var/www/uploads/) and serve them via a PHP download script.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact Valters IT.