Authenticated Local File Inclusion in Camaleon CMS

Camaleon CMS versions prior to 2.8.2 are vulnerable to a path traversal vulnerability tracked as CVE-2024-46987. The vulnerability exists within the '/admin/media/download_private_file' endpoint, which fails to properly sanitize the 'file' parameter. An authenticated user can supply crafted input containing directory traversal sequences to access sensitive files on the underlying filesystem. This flaw enables the exfiltration of critical configuration files, environment variables, and SSH private keys, potentially leading to further compromise of the server or connected infrastructure. The issue has a CVSS score of 7.7, and public exploit code is actively circulating, significantly lowering the barrier for exploitation.

Attack Chain

1. Attacker obtains a valid session cookie (auth_token) through social engineering or credential harvesting.
2. Attacker authenticates to the Camaleon CMS management interface.
3. Attacker navigates to the '/admin/media/download_private_file' endpoint.
4. Attacker crafts an HTTP GET or POST request targeting the 'file' parameter.
5. Attacker injects traversal sequences (e.g., '../') into the 'file' parameter to escape the intended directory.
6. The application backend processes the request and retrieves the requested file from the filesystem.
7. The application returns the contents of the sensitive file to the attacker in the HTTP response.
8. Attacker parses the response to exfiltrate system secrets, configuration details, or cryptographic keys.

Impact

Successful exploitation allows for the unauthorized disclosure of sensitive server-side information. Impact includes the compromise of database credentials found in configuration files, access to system-level environment variables, and the acquisition of private SSH keys. These findings can facilitate lateral movement and full system takeover.

Recommendation

Prioritize the immediate upgrade of all Camaleon CMS instances to version 2.8.2 or later to eliminate the vulnerable endpoint code. Deploy the provided Sigma rule to web server access logs to detect and alert on suspicious requests containing traversal patterns directed at the identified endpoint.

Rules

• title: "Detect CVE-2024-46987 Exploitation - Path Traversal in download_private_file" description: "Detects exploitation attempts against CVE-2024-46987 by looking for directory traversal patterns in the 'file' parameter of the vulnerable download_private_file endpoint." logsource: category: "webserver" detection: selection: cs-uri-stem|endswith: "/admin/media/download_private_file" cs-uri-query|contains:
• "../"
• "..%2f"
• "..\" condition: selection level: "high" tags:
• "attack.initial_access"
• "attack.t1190" falsepositives:
• "Legitimate administrative file access if the application uses unconventional path naming" tests: positive:
• name: "Traversal attempt in file parameter" data:
• cs-uri-stem: "/admin/media/download_private_file" cs-uri-query: "file=../../etc/passwd" negative:
• name: "Normal file download request" data:
• cs-uri-stem: "/admin/media/download_private_file" cs-uri-query: "file=user_upload.pdf" handoff: detection_confidence: "high" required_telemetry:
• log_source: "Web Server Access Logs" event_or_channel: "HTTP Request Logs" required_fields:
• "cs-uri-stem"
• "cs-uri-query" availability: "available" notes: "Requires access to full URI stem and query strings" validation: status: "needs_environment_validation" steps:
• "Send a safe request to a test instance with a non-existent file path containing ../ to verify alert triggering" expected_telemetry: "Web server log entry containing the traversal pattern" pass_criteria: "Detection rule identifies the traversal attempt in the logs" known_evasions:
• "URL encoding obfuscation or double encoding not covered by the rule" limitations:
• "Will not catch attempts using POST body parameters if the log source only captures the URI" tuning:
• source: "Log source" guidance: "Ensure your web server logs capture the full query string" portability_notes:
• platform: "Splunk" note: "Standard web logs usually populate the uri_query field" suggested_owner: "Detection Engineering"