CVE-2024-58302

Executive Summary

CVE-2024-58302 is a Local File Inclusion (LFI) vulnerability discovered in FoF Pretty Mail version 1.1.2. This flaw allows authenticated administrative users to include arbitrary server files within email templates. By injecting file inclusion payloads into the template settings, an attacker can read sensitive system files (e.g., /etc/passwd) during the email generation process. The vulnerability is currently unpatched, and no official fix has been released by the vendor. The CVSS score is 0.0 due to incomplete NVD data, but based on the technical details, the actual severity is medium to high, given the potential for sensitive data exposure.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) or a WordPress plugin. It is a standalone application (FoF Pretty Mail) and should be treated as a custom software supply chain risk. Organizations using this software should assess its deployment and consider immediate isolation or removal until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires administrative access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires administrative privileges, but once obtained, an attacker can read arbitrary files on the server, potentially exposing credentials, configuration files, and other sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the email template functionality of FoF Pretty Mail 1.1.2. The application allows administrators to define custom email templates using a templating engine. The flaw occurs because user-supplied input (specifically, file paths or inclusion directives) is not properly sanitized or validated before being passed to a file inclusion function (e.g., include(), file_get_contents(), or similar).

Attack Flow:

1. An attacker gains administrative access to the FoF Pretty Mail interface.
2. The attacker navigates to the email template settings.
3. Instead of a legitimate template path, the attacker inserts a file inclusion payload, such as ../../../../etc/passwd or a PHP wrapper like php://filter/convert.base64-encode/resource=/etc/passwd.
4. When the system generates an email (e.g., during a test send or actual mailing), the vulnerable code includes the attacker-specified file.
5. The contents of the file are embedded into the email output, which the attacker can then view or capture.

Root Cause: Lack of input validation and insufficient path sanitization in the template inclusion mechanism. The application likely uses a function like include() or file_get_contents() with user-controlled input without restricting the base directory or filtering path traversal sequences.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (PHP example):

// Vulnerable: directly uses user input for file inclusion
$template = $_POST['template_path'];
$content = file_get_contents($template);
// or
include($template);

Patched Code (Hypothetical):

// Patched: restrict to a specific directory and sanitize input
$allowed_dir = '/var/www/prettymail/templates/';
$template = basename($_POST['template_path']); // Remove path traversal
$full_path = $allowed_dir . $template;
if (file_exists($full_path) && strpos(realpath($full_path), $allowed_dir) === 0) {
    $content = file_get_contents($full_path);
} else {
    // Handle error
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to FoF Pretty Mail 1.1.2.
• Network access to the web interface.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to the email template configuration page.
3. In the template path field, enter a payload such as:

   ../../../../etc/passwd
   

   or for PHP wrappers:

   php://filter/convert.base64-encode/resource=/etc/passwd
   

4. Trigger an email generation (e.g., send a test email).
5. The email output will contain the contents of /etc/passwd (or the requested file).

Lab Setup:

• Install FoF Pretty Mail 1.1.2 on a local server (e.g., using XAMPP or Docker).
• Create an admin account.
• Use a web proxy (e.g., Burp Suite) to intercept and modify the template path parameter.

Blue Team

Detection:

• Monitor for unusual file paths in HTTP requests to the template configuration endpoint.
• Look for path traversal sequences (../, ..\\) or PHP wrapper strings (php://, file://) in POST parameters.
• Alert on any email generation activity that includes unexpected file contents.

Hunting:

• Search web server logs for requests containing template_path with suspicious patterns.
• Check email logs for messages containing system file paths or sensitive data.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /proc/self/environ, /var/log/apache2/access.log
• HTTP Requests: POST requests to /admin/template/save or similar endpoints with template_path parameter containing ../ or php://
• Email Content: Emails containing lines like root:x:0:0:root:/root:/bin/bash or other system file contents.
• Log Entries: Web server logs showing 404 or 500 errors for template paths that are actually file inclusion attempts.

Detection Engineering

YARA Rule

rule CVE_2024_58302_LFI_PrettyMail {
    meta:
        description = "Detects LFI attempts targeting FoF Pretty Mail 1.1.2"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58302"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $php_wrapper = /php:\/\//
        $file_wrapper = /file:\/\//
        $sensitive_file = /\/etc\/passwd|\/etc\/shadow|\/proc\/self\/environ/
    condition:
        any of ($path_traversal) or any of ($php_wrapper) or any of ($file_wrapper) or any of ($sensitive_file)
}

Sigma Rule

title: CVE-2024-58302 LFI Attempt on FoF Pretty Mail
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal or PHP wrapper usage in template settings of FoF Pretty Mail
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'template_path'
        cs-uri-query|re:
            - '\.\.\/'
            - '\.\.\\'
            - 'php:\/\/'
            - 'file:\/\/'
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-58302 LFI Attempt on FoF Pretty Mail"; flow:to_server,established; content:"POST"; http_method; content:"template_path"; http_client_body; pcre:"/(\.\.\/|\.\.\\|php:\/\/|file:\/\/)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take FoF Pretty Mail offline or restrict network access to trusted administrators only.
2. Apply input validation: Implement strict input validation on the template_path parameter. Only allow alphanumeric characters and a single dot for file extensions (e.g., .html).
3. Restrict file inclusion: Use a whitelist of allowed template files stored in a dedicated directory. Do not allow user input to directly specify file paths.
4. Disable PHP wrappers: If using PHP, disable dangerous wrappers like php:// and file:// in the php.ini configuration.

Long-Term Fix:

• Contact the vendor (FoF) for an official patch. If none is forthcoming, consider migrating to an alternative email templating solution.
• Implement a Web Application Firewall (WAF) rule to block path traversal and PHP wrapper patterns.
• Conduct a security audit of the entire application to identify similar vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis or remediation support, contact Valters IT.