CVE-2024-57170

Executive Summary

CVE-2024-57170 is a critical directory traversal vulnerability identified in SOPlanning version 1.53.00. The flaw resides in the /process/upload.php script, specifically within the fichier_to_delete parameter. An authenticated attacker can supply file paths containing directory traversal sequences (e.g., ../) to delete arbitrary files outside the intended upload directory. This can lead to denial of service (DoS) or disruption of application functionality by removing essential system or application files. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to its potential impact. No patch is currently available, and a public proof-of-concept (PoC) exists.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion impacts integrity.
• Availability (A): High (H) – File deletion can cause DoS.

Threat Level: High. The ability to delete arbitrary files can cripple the application or the underlying server.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the file deletion functionality of SOPlanning's upload handler. The fichier_to_delete parameter is not properly sanitized, allowing an attacker to inject ../ sequences to navigate up the directory tree. For example, an attacker could specify ../../config.php to delete a configuration file outside the upload directory.

The attack flow:

1. Authenticate to SOPlanning.
2. Send a POST request to /process/upload.php with fichier_to_delete=../../somefile.txt.
3. The application deletes the specified file without validation.

This can be used to delete critical files such as:

• Configuration files (e.g., config.php, .env)
• Application binaries or scripts
• Log files (to cover tracks)
• System files (if the web server has sufficient permissions)

Vulnerable vs. Patched Code

Vulnerable Code (SOPlanning 1.53.00):

// /process/upload.php (simplified)
$file_to_delete = $_POST['fichier_to_delete'];
if (file_exists($file_to_delete)) {
    unlink($file_to_delete);
}

The code directly uses user input without sanitization, allowing path traversal.

Patched Code (Hypothetical):

// /process/upload.php (patched)
$file_to_delete = basename($_POST['fichier_to_delete']);
$upload_dir = '/var/www/uploads/';
$file_path = $upload_dir . $file_to_delete;
if (file_exists($file_path) && strpos(realpath($file_path), realpath($upload_dir)) === 0) {
    unlink($file_path);
}

The patched version uses basename() to strip directory components and validates that the resolved path is within the intended upload directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for SOPlanning.
• Network access to the SOPlanning instance.

Exploit Steps:

1. Log in to SOPlanning.
2. Craft a POST request to /process/upload.php with the fichier_to_delete parameter set to a path traversal string.
3. Example using curl:

   curl -X POST -d "fichier_to_delete=../../config.php" -b "session=valid_session" http://target/process/upload.php
   

4. Verify deletion by checking if the target file is no longer accessible.

Lab Setup:

• Install SOPlanning 1.53.00 on a local server (e.g., using Docker or a LAMP stack).
• Create a test user account.
• Place a dummy file (e.g., test.txt) in the web root.
• Execute the exploit to delete the dummy file.

Blue Team

Detection:

• Monitor for POST requests to /process/upload.php with fichier_to_delete containing ../ or other path traversal patterns.
• Alert on file deletion events outside the upload directory.
• Use file integrity monitoring (FIM) to detect unexpected file deletions.

Mitigation:

• Apply input validation and sanitization to the fichier_to_delete parameter.
• Restrict web server permissions to prevent deletion of critical system files.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /process/upload.php with fichier_to_delete containing ../ or absolute paths.
  • Unusual file deletion events in server logs.
• File System:
  • Missing critical files (e.g., config.php, .env, index.php).
  • Unexpected empty directories.
• Logs:
  • Web server access logs showing requests to /process/upload.php with suspicious parameters.
  • Application error logs indicating failed file operations.

Detection Engineering

YARA Rule

rule CVE_2024_57170_SOPlanning_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in SOPlanning upload.php"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-57170"
    strings:
        $traversal = /fichier_to_delete=[^&]*\.\.\//
    condition:
        $traversal
}

Sigma Rule

title: SOPlanning Directory Traversal in upload.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in SOPlanning's upload.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/process/upload.php'
        cs-uri-query|contains: 'fichier_to_delete='
        cs-uri-query|re: '\.\.\/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57170 SOPlanning Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/process/upload.php"; http_uri; content:"fichier_to_delete="; http_client_body; pcre:"/fichier_to_delete=[^&]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality: If possible, restrict access to /process/upload.php via .htaccess or web server configuration.
2. Apply input validation: Sanitize the fichier_to_delete parameter to prevent path traversal.
3. Restrict file permissions: Ensure the web server user has minimal write/delete permissions.

Long-Term Fix:

• Upgrade to a patched version of SOPlanning when available.
• Implement a Web Application Firewall (WAF) with rules to block path traversal attempts.
• Conduct a security audit of the application code.

Workaround:

• Use a reverse proxy to filter requests containing ../ in the fichier_to_delete parameter.

Valters IT
Securing Digital Frontiers