YouDataSum CPAS Audit Management System Path Traversal (CVE-2024-58396)

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability in the /cpasm4/plugInManController/downPlugs endpoint. Unauthenticated attackers can exploit the fileId parameter by injecting path traversal sequences (e.g., ../) to read arbitrary files from the underlying file system. The Shadowserver Foundation observed active exploitation of this vulnerability beginning January 13, 2025.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the CPAS Audit Management System. This can lead to the exposure of sensitive configuration files, credentials, or system files such as /etc/passwd.

Recommendation

• Inventory all instances of YouDataSum CPAS Audit Management System V4.
• Patch or upgrade the affected system immediately, following guidance from YouDataSum.
• Deploy the provided Sigma rule to detect exploitation attempts targeting the identified endpoint.
• Review web server access logs for requests containing suspicious path traversal sequences (e.g., ../, ..%2f) directed at the /cpasm4/plugInManController/downPlugs endpoint.