Arbitrary File Read in Inspur Haiyue HCM Cloud

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint. The flaw arises from insufficient validation of user-supplied path parameters, specifically the 'index' and 'ext' query parameters. Unauthenticated remote attackers can leverage this vulnerability to perform directory traversal, allowing them to read arbitrary files from the underlying filesystem. This risk includes the unauthorized disclosure of sensitive information such as /etc/passwd, application database files, and critical system configuration files. Evidence of exploitation in the wild was first reported by the Shadowserver Foundation on November 4, 2024. Given the nature of the vulnerability and the potential for credential harvesting or infrastructure discovery, immediate patching or restriction of access to the HCM cloud interface is recommended for organizations currently running affected versions.

Attack Chain

1. Attacker performs reconnaissance to identify public-facing instances of Inspur Haiyue HCM Cloud.
2. Attacker probes the /api/model_report/file/download endpoint to test for path traversal vulnerabilities.
3. Attacker crafts a malicious HTTP GET request targeting the /api/model_report/file/download path.
4. Attacker injects traversal sequences into the 'index' and 'ext' parameters (e.g., /api/model_report/file/download?index=/&ext=etc/passwd).
5. The application fails to sanitize the input, resolving the path relative to the root directory.
6. The server returns the contents of the requested file in the HTTP response body.
7. Attacker parses the response to extract sensitive credentials or system configuration data.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to sensitive files residing on the server. Potential consequences include the theft of system credentials (e.g., /etc/passwd), database connection strings, API keys, or configuration files that could facilitate further compromise of the internal network and HCM system data.

Recommendation

1. Prioritize patching or updating Inspur Haiyue HCM Cloud to the version provided by the vendor that addresses CVE-2024-58387.
2. Apply the Sigma rule below to detect exploitation attempts targeting the /api/model_report/file/download endpoint.
3. Restrict access to the HCM Cloud administrative and report endpoints at the network edge to authorized IPs only.
4. Monitor web server logs for HTTP GET requests containing directory traversal sequences (e.g., ../, /etc/passwd) targeting the identified vulnerable endpoint.