{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/tuzitio/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2024-46987"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Camaleon CMS (\u003c 2.8.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Tuzitio"],"content_html":"\u003cp\u003eCamaleon CMS versions prior to 2.8.2 are vulnerable to a path traversal vulnerability tracked as CVE-2024-46987. The vulnerability exists within the '/admin/media/download_private_file' endpoint, which fails to properly sanitize the 'file' parameter. An authenticated user can supply crafted input containing directory traversal sequences to access sensitive files on the underlying filesystem. This flaw enables the exfiltration of critical configuration files, environment variables, and SSH private keys, potentially leading to further compromise of the server or connected infrastructure. The issue has a CVSS score of 7.7, and public exploit code is actively circulating, significantly lowering the barrier for exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a valid session cookie (auth_token) through social engineering or credential harvesting.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the Camaleon CMS management interface.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the '/admin/media/download_private_file' endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET or POST request targeting the 'file' parameter.\u003c/li\u003e\n\u003cli\u003eAttacker injects traversal sequences (e.g., '../') into the 'file' parameter to escape the intended directory.\u003c/li\u003e\n\u003cli\u003eThe application backend processes the request and retrieves the requested file from the filesystem.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the sensitive file to the attacker in the HTTP response.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to exfiltrate system secrets, configuration details, or cryptographic keys.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized disclosure of sensitive server-side information. Impact includes the compromise of database credentials found in configuration files, access to system-level environment variables, and the acquisition of private SSH keys. These findings can facilitate lateral movement and full system takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate upgrade of all Camaleon CMS instances to version 2.8.2 or later to eliminate the vulnerable endpoint code. Deploy the provided Sigma rule to web server access logs to detect and alert on suspicious requests containing traversal patterns directed at the identified endpoint.\u003c/p\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003etitle: \u0026quot;Detect CVE-2024-46987 Exploitation - Path Traversal in download_private_file\u0026quot;\ndescription: \u0026quot;Detects exploitation attempts against CVE-2024-46987 by looking for directory traversal patterns in the 'file' parameter of the vulnerable download_private_file endpoint.\u0026quot;\nlogsource:\ncategory: \u0026quot;webserver\u0026quot;\ndetection:\nselection:\ncs-uri-stem|endswith: \u0026quot;/admin/media/download_private_file\u0026quot;\ncs-uri-query|contains:\u003c/li\u003e\n\u003cli\u003e\u0026quot;../\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;..%2f\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;..\\\u0026quot;\ncondition: selection\nlevel: \u0026quot;high\u0026quot;\ntags:\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.initial_access\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.t1190\u0026quot;\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate administrative file access if the application uses unconventional path naming\u0026quot;\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Traversal attempt in file parameter\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-uri-stem: \u0026quot;/admin/media/download_private_file\u0026quot;\ncs-uri-query: \u0026quot;file=../../etc/passwd\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Normal file download request\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-uri-stem: \u0026quot;/admin/media/download_private_file\u0026quot;\ncs-uri-query: \u0026quot;file=user_upload.pdf\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;high\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;Web Server Access Logs\u0026quot;\nevent_or_channel: \u0026quot;HTTP Request Logs\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-stem\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-query\u0026quot;\navailability: \u0026quot;available\u0026quot;\nnotes: \u0026quot;Requires access to full URI stem and query strings\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\nsteps:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Send a safe request to a test instance with a non-existent file path containing ../ to verify alert triggering\u0026quot;\nexpected_telemetry: \u0026quot;Web server log entry containing the traversal pattern\u0026quot;\npass_criteria: \u0026quot;Detection rule identifies the traversal attempt in the logs\u0026quot;\nknown_evasions:\u003c/li\u003e\n\u003cli\u003e\u0026quot;URL encoding obfuscation or double encoding not covered by the rule\u0026quot;\nlimitations:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Will not catch attempts using POST body parameters if the log source only captures the URI\u0026quot;\ntuning:\u003c/li\u003e\n\u003cli\u003esource: \u0026quot;Log source\u0026quot;\nguidance: \u0026quot;Ensure your web server logs capture the full query string\u0026quot;\nportability_notes:\u003c/li\u003e\n\u003cli\u003eplatform: \u0026quot;Splunk\u0026quot;\nnote: \u0026quot;Standard web logs usually populate the uri_query field\u0026quot;\nsuggested_owner: \u0026quot;Detection Engineering\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T20:40:19Z","date_published":"2026-10-18T20:40:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-46987/","summary":"An authenticated path traversal vulnerability in Camaleon CMS allows attackers to read arbitrary files from the host server via the 'download_private_file' endpoint.","title":"Authenticated Local File Inclusion in Camaleon CMS","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-46987/"}],"language":"en","title":"CraftedSignal Threat Feed - Tuzitio","version":"https://jsonfeed.org/version/1.1"}