CVE-2024-55019

Executive Summary

CVE-2024-55019 discloses an incorrect access control vulnerability in the download_wb.cgi component of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011. This flaw allows an unauthenticated attacker to download arbitrary files from the device, potentially exposing sensitive configuration data, credentials, or firmware internals. The vulnerability is classified under CWE-284 (Improper Access Control) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data, but based on the description (unauthenticated, network-accessible, arbitrary file download), a reasonable estimate would be:

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Impact: Confidentiality impact is High due to potential exposure of sensitive files. Integrity and Availability are not directly affected.

Deep Dive & Mechanics

The vulnerability resides in the download_wb.cgi CGI script, which is part of the Weintek easyweb web interface. The script is intended to serve specific files (likely web-related resources) but fails to validate the requested file path, allowing directory traversal or arbitrary file access. An unauthenticated attacker can send a crafted HTTP request to download_wb.cgi with a path parameter pointing to any file on the device’s filesystem, such as /etc/passwd, configuration databases, or firmware binaries.

The root cause is a lack of proper access control checks and input sanitization in the CGI handler. The script does not verify that the requesting user is authenticated or that the requested file is within an allowed directory. This is a classic example of CWE-284 (Improper Access Control) combined with CWE-22 (Path Traversal).

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code is in the download_wb.cgi script. A patched version would likely include:

• Authentication checks before processing any file download request.
• Input validation to restrict file paths to a whitelist of allowed directories (e.g., /var/www/web/).
• Use of a chroot jail or filesystem sandboxing to limit access.

Example of vulnerable pseudo-code:

# Vulnerable: No access control, no path validation
def download_wb():
    file_path = request.GET['file']
    with open(file_path, 'rb') as f:
        return f.read()

Example of patched pseudo-code:

# Patched: Authentication and path whitelist
def download_wb():
    if not is_authenticated(request):
        return 403
    file_path = request.GET['file']
    allowed_dir = '/var/www/web/'
    if not file_path.startswith(allowed_dir):
        return 403
    with open(file_path, 'rb') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a Weintek cMT-3072XH2 with easyweb v2.1.53 in an isolated network.
2. Ensure the web interface is accessible on port 80 or 443.

Exploitation Steps:

1. Identify the target device via Shodan dork: weintek cMT-3072XH2.
2. Send a crafted HTTP GET request to download arbitrary files:

   GET /download_wb.cgi?file=/etc/passwd HTTP/1.1
   Host: <target_ip>
   

3. If successful, the response will contain the contents of /etc/passwd.
4. Further enumerate sensitive files such as:
   • /etc/shadow (if readable)
   • /var/www/web/config.db (configuration database)
   • /firmware.bin (firmware image)

Example using curl:

curl -v "http://<target_ip>/download_wb.cgi?file=/etc/passwd"

Blue Team

Detection:

• Monitor HTTP logs for requests to /download_wb.cgi with suspicious file parameters containing path traversal sequences (e.g., ../, %2e%2e/).
• Alert on multiple requests to different file paths from the same source IP.
• Use the Sigma rule provided in Detection Engineering.

Mitigation:

• Block access to /download_wb.cgi from untrusted networks using a WAF or firewall.
• Apply vendor patch when available.
• Restrict file system permissions to prevent the web server user from reading sensitive files.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /download_wb.cgi?file= with path traversal patterns.
  • Source IPs scanning for Weintek devices on port 80/443.
• File System:
  • Unauthorized access to /etc/passwd, /etc/shadow, /var/www/web/config.db.
• Logs:
  • Web server logs showing download_wb.cgi requests with non-standard file paths.

Detection Engineering

YARA Rule

rule CVE_2024_55019_Weintek_File_Download {
    meta:
        description = "Detects attempts to exploit CVE-2024-55019 via path traversal in download_wb.cgi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55019"
    strings:
        $cgi = "download_wb.cgi" nocase
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "%2e%2e/" ascii wide
        $traversal4 = "..%2f" ascii wide
        $sensitive = "/etc/passwd" ascii wide
        $sensitive2 = "/etc/shadow" ascii wide
        $sensitive3 = "config.db" ascii wide
    condition:
        $cgi and any of ($traversal*) or ($cgi and any of ($sensitive*))
}

Sigma Rule

title: CVE-2024-55019 Weintek Arbitrary File Download
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to download_wb.cgi with path traversal or sensitive file paths
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: "/download_wb.cgi"
        cs-uri-query:
            - "*file=*../*"
            - "*file=*%2e%2e/*"
            - "*file=*/etc/passwd*"
            - "*file=*/etc/shadow*"
            - "*file=*config.db*"
    condition: selection
falsepositives:
    - Legitimate file downloads from allowed directories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55019 Weintek Arbitrary File Download Attempt"; flow:to_server; content:"GET"; http_method; content:"/download_wb.cgi"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*(\.\.\/|%2e%2e\/|\/etc\/passwd|\/etc\/shadow|config\.db)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict network access to the web interface to trusted IPs only.
   • Deploy a WAF rule to block requests to /download_wb.cgi with path traversal patterns.
   • Monitor logs for exploitation attempts.

2. Vendor Patch:

   • Contact Weintek for a firmware update. No patch is currently available.

3. Long-term:

   • Implement proper access control and input validation in all CGI scripts.
   • Use a chroot environment for the web server.
   • Conduct regular security audits of embedded devices.

Valters IT
DevSecOps & Cyber Threat Intelligence