CVE-2024-58388

Executive Summary

CVE-2024-58388 is an unauthenticated local file inclusion (path traversal) vulnerability in Sharp and Toshiba Tec rebranded multifunction printers, reachable through the installed_emanual_down.html endpoint. A remote, unauthenticated attacker can manipulate the path parameter with directory traversal sequences (e.g., path=/manual/../../../<path>) to read arbitrary files on the device filesystem, including /etc/passwd, system configuration files, and coredump files that may contain credentials. With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw is trivially network-exploitable with high confidentiality impact; exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30, indicating active in-the-wild scanning. No patch, no public PoC, and no CISA KEV listing currently exist.

Technical Analysis

The vulnerability is a canonical path traversal (CWE-22) exposed via a web-accessible component. The affected endpoint, installed_emanual_down.html, is part of the device's embedded manual download functionality. This handler accepts a path parameter that is intended to reference files within a fixed manual directory (the description references /manual/ as the intended root). Because the input is not adequately canonicalized or confined to that directory, an attacker can inject traversal sequences such as path=/manual/../../../<path> to escape the intended root and resolve arbitrary absolute or relative files on the underlying filesystem.

Key characteristics derivable from the available data:

• Attack vector: Network (AV:N) — the endpoint is reachable over the device's HTTP(S) management/web interface.
• Authentication: None required (PR:N) to reach the vulnerable handler. No user interaction (UI:N).
• Impact class: Confidentiality-only (C:H / I:N / A:N). The vulnerability is a read primitive; the description does not establish arbitrary write, code execution, or DoS.
• Disclosure targets named in the description: /etc/passwd (account enumeration / OS fingerprinting), coredump files that may contain credentials (memory-resident secrets, session data, or service account material), and system configuration files (device configuration, potentially embedded credentials or network details).

The precise parameter parsing, sanitization routine, and web server implementation are not disclosed in the available description. No function names, class names, or additional endpoints beyond installed_emanual_down.html and the path parameter should be assumed. The absence of a published PoC and of version metadata means the exact affected firmware range is unknown; affected scope is inferred at the product-family level.

Because the same firmware/rebranding relationship exists between Sharp and Toshiba Tec devices, the vulnerable component is likely shared across both product lines, widening the affected population beyond a single vendor's badge.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the NVD description and the CWE-22 vulnerability class.

1. Reconnaissance / target identification. An attacker identifies internet-exposed multifunction printers running Sharp (or Toshiba Tec rebranded) firmware by locating hosts that serve the installed_emanual_down.html endpoint on their embedded web interface. Mass scanning activity consistent with this pattern was observed by the Shadowserver Foundation beginning 2024-07-30, indicating automated discovery is already occurring.

2. Triggering the flaw. The attacker sends an HTTP request to the installed_emanual_down.html endpoint, supplying a crafted path parameter. Because the handler fails to prevent directory traversal, a value such as path=/manual/../../../<target> escapes the intended /manual/ directory. No authentication is required to reach this handler.

3. Payload / execution method. The attack is a direct file-read primitive driven by the traversal value in the path parameter. The attacker iterates candidate traversal depths and target paths to read files of interest. Based on the description, high-value targets include /etc/passwd and system configuration files, with coredump files specifically noted as potentially containing credentials.

4. Post-exploitation impact. The attacker obtains file contents returned by the endpoint. Reading /etc/passwd supports account enumeration and OS identification; reading configuration files may reveal device settings, network topology details, and embedded secrets; reading coredump files may yield credentials (the description explicitly flags coredump files as a credential source). These artifacts can enable lateral movement, credential reuse against other services, or deeper compromise of the print infrastructure. The description does not establish code execution or persistence, so the confirmed impact ceiling is sensitive-information disclosure.

Impact Assessment

The CVSS v3.1 vector (7.5, High) decomposes as follows: AV:N — exploitable remotely across a network; AC:L — no special conditions or race required; PR:N — no authentication; UI:N — no victim interaction; S:U — impact confined to the vulnerable device's security scope; C:H / I:N / A:N — total loss of confidentiality, no integrity or availability impact.

Business impact centers on credential and configuration exposure. Multifunction printers commonly reside on corporate LANs and increasingly on internet-facing management interfaces, and they frequently hold scan-to-email/SMB credentials, LDAP bind credentials, address books, and stored documents. Disclosure of configuration files or credential-bearing coredumps can translate directly into unauthorized access to adjacent systems (file shares, mail, directory services).

Blast radius: Any internet-exposed or internal-network-reachable Sharp or Toshiba Tec multifunction printer exposing the vulnerable installed_emanual_down.html endpoint. Given confirmed internet scanning since 2024-07-30, exposed devices should be treated as at active risk. Because no fixed version exists, the entire identified population remains exposed until mitigations are applied.

Detection Guidance

Sigma Rule

title: Sharp/Toshiba Tec MFP Path Traversal in installed_emanual_down.html
id: 7c2f9a10-58388-4b1e-9d2a-cve202458388
status: experimental
description: Detects directory traversal attempts against the installed_emanual_down.html endpoint (CVE-2024-58388)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-58388
author: Threat Intelligence
date: 2024/07/30
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'installed_emanual_down.html'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%2F'
      - '%2e%2e/'
      - '%2e%2e%2f'
  condition: selection_endpoint and selection_traversal
falsepositives:
  - Legitimate administrative access with unusual path values (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2024.58388

YARA Rule

rule CVE_2024_58388_MFP_Traversal_Request
{
    meta:
        description = "Detects HTTP request artifacts targeting installed_emanual_down.html with traversal (CVE-2024-58388)"
        author = "Threat Intelligence"
        date = "2024-07-30"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-58388"
    strings:
        $ep  = "installed_emanual_down.html" ascii nocase
        $p1  = "path=/manual/" ascii nocase
        $t1  = "../" ascii
        $t2  = "..%2f" ascii nocase
        $t3  = "%2e%2e%2f" ascii nocase
        $f1  = "/etc/passwd" ascii
    condition:
        $ep and $p1 and any of ($t*) or ($ep and any of ($t*) and $f1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-58388 Sharp/Toshiba Tec MFP path traversal in installed_emanual_down.html"; flow:established,to_server; http.uri; content:"installed_emanual_down.html"; nocase; http.uri; content:"path="; nocase; http.uri; pcre:"/(\.\.\/|\.\.%2f|%2e%2e%2f)/i"; classtype:attempted-recon; reference:cve,2024-58388; reference:url,nvd.nist.gov/vuln/detail/CVE-2024-58388; sid:202458388; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET"
      and url.path endswith "installed_emanual_down.html"
      and url.query contains "path=" ]
  [ network where url.path endswith "installed_emanual_down.html"
      and (url.query contains "../" or url.query contains "..%2f" or url.query contains "%2e%2e%2f") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(cs_uri_stem, url, uri_path)
| eval query = coalesce(cs_uri_query, url_query, uri_query)
| where like(uri, "%installed_emanual_down.html%")
| where match(query, "(?i)(\.\./|\.\.%2f|%2e%2e%2f)")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(query) as traversal_payloads
        by src_ip, dest_ip, uri
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2024-58388,">
  <rule id="202458388" level="12">
    <if_sid>31100</if_sid>
    <field name="url">installed_emanual_down.html</field>
    <regex>(\.\./|\.\.%2f|%2e%2e%2f)</regex>
    <description>CVE-2024-58388: Path traversal attempt against installed_emanual_down.html (Sharp/Toshiba Tec MFP)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed firmware version, or workaround has been published for CVE-2024-58388.

1) Immediate mitigations

• Remove internet exposure of the device web interface. Place multifunction printers behind a firewall/VPN and restrict the management web interface to trusted administrative networks only.
• Where the embedded web server is not required, disable it. If the installed_emanual_down.html manual-download functionality is non-essential, restrict or block access to that endpoint via a reverse proxy or WAF rule (reject requests containing path= with traversal sequences or targeting this endpoint).
• Apply network segmentation so that printers cannot reach credential stores or sensitive file shares, limiting the value of any credential disclosed via coredump or configuration file reads.
• Monitor for and suppress automatic scanning traffic matching the confirmed Shadowserver-observed pattern.

2) Patch/upgrade steps

• There is currently no patch. Monitor Sharp and Toshiba Tec security advisories for a fixed firmware release. Until a version is published, affected firmware ranges cannot be enumerated from available data — inventory all Sharp/Toshiba Tec MFPs and treat every device exposing the endpoint as potentially vulnerable.
• Establish a firmware-update process so devices can be updated promptly when a fix becomes available.

3) Long-term hardening

• Rotate any credentials that may reside on or be reachable from affected devices (scan-to-email/SMB, LDAP bind, admin passwords), and rotate credentials that may appear in coredump or configuration files.
• Disable coredump retention on exposed devices where configurable, reducing the credential-exposure surface.
• Enforce strong, unique administrative credentials and disable default accounts on print infrastructure.
• Add the Sigma/Suricata/Splunk detections above to production monitoring to identify historical or ongoing exploitation.

References

• NVD — CVE-2024-58388: https://nvd.nist.gov/vuln/detail/CVE-2024-58388
• MITRE CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• Shadowserver Foundation — exploitation evidence first observed 2024-07-30 (per NVD description)
• CISA Known Exploited Vulnerabilities catalog: CVE-2024-58388 is not listed as of this report
• Vendor references: no Sharp or Toshiba Tec advisory identified. Insufficient technical detail available beyond the NVD description for vendor-specific guidance.

Note on threat activity: No named threat actor campaign has been attributed to CVE-2024-58388. The only exploitation evidence referenced is the Shadowserver Foundation observation of scanning activity starting 2024-07-30. No public PoC, Nuclei template, or exploit code was identified in available sources.