Unauthenticated Path Traversal in Hsclabs Mailinspector

HSC Mailinspector versions up to and including 5.2.18 are vulnerable to an unauthenticated path traversal vulnerability (CVE-2024-34470). The issue resides in the '/public/loader.php' script, which fails to properly sanitize the 'path' parameter. An unauthenticated attacker can exploit this flaw to escape the application's web root directory and perform arbitrary file reads on the underlying server. Because the application processes the 'path' parameter without verifying if the requested resource resides within authorized directories, an attacker can access sensitive files such as '/etc/passwd' or application configuration files by supplying specially crafted directory traversal sequences (e.g., '../'). The widespread availability of proof-of-concept exploits on platforms such as GitHub and KitPloit significantly increases the likelihood of exploitation against internet-facing Mailinspector instances.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Mailinspector instances.
2. Attacker crafts a malicious HTTP GET request targeting the '/mailinspector/public/loader.php' endpoint.
3. The request includes a 'path' query parameter containing traversal sequences (e.g., '../../../../etc/passwd').
4. The Mailinspector server receives the request and processes the 'loader.php' script.
5. The script fails to validate the input, allowing the application to traverse outside the intended directory.
6. The web server reads the contents of the requested file from the filesystem.
7. The server returns the file content in the HTTP response, allowing the attacker to exfiltrate sensitive data.

Impact

Successful exploitation allows an unauthenticated attacker to read any file on the server to which the web application process has access. This can lead to the exposure of credentials, configuration files, system files, and proprietary data. In some cases, this exposure can provide sufficient information for an attacker to escalate privileges or gain full control of the affected server.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade Hsclabs Mailinspector to version 5.2.19 or later to apply the official vendor patch.
• Deploy the provided Sigma rule to detect exploitation attempts targeting the 'path' parameter in 'loader.php'.
• Monitor web access logs for HTTP requests to '/public/loader.php' containing sequences like '..' or directory path patterns, particularly those that do not result in a 404 status.
• Implement a Web Application Firewall (WAF) rule to block requests to the 'loader.php' file containing path traversal characters (e.g., '../', '%2e%2e%2f').