Exploit
CVE-2024-47769

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Published: Oct 4, 2024 / Updated: 46d ago

010
CVSS 7.5EPSS 0.04%High
CVE info copied to clipboard

Summary

IDURAR, an open source ERP CRM accounting invoicing software, contains a vulnerability in the corePublicRouter.js file. The public endpoint is accessible to unauthenticated users, and user input is directly appended to the join statement without proper validation. This allows attackers to send URL encoded malicious payloads. By adding an encoded string at the subpath location, an attacker can escape the directory structure and read system files.

Impact

This vulnerability allows unauthorized access to sensitive system files, potentially leading to information disclosure. An attacker can exploit this flaw to read confidential data, which could include system configurations, user information, or other critical files. The impact is severe as it compromises the confidentiality of the system without requiring user interaction or elevated privileges.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in a commit on GitHub, and a security advisory has been published. Users should update to a version newer than 4.1.0 to mitigate this vulnerability.

Mitigation

1. Update IDURAR to a version newer than 4.1.0. 2. If immediate updating is not possible, implement strict input validation and sanitization for all user inputs, especially those used in file path operations. 3. Apply the principle of least privilege to limit access to sensitive system files. 4. Consider implementing additional security measures such as Web Application Firewalls (WAF) to filter malicious requests. 5. Regularly monitor and audit system logs for any suspicious file access attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

CVE Assignment

NVD published the first details for CVE-2024-47769

Oct 4, 2024 at 3:15 PM
CVSS

A CVSS base score of 7.5 has been assigned.

Oct 4, 2024 at 3:21 PM / nvd
First Article

Feedly found the first article mentioning CVE-2024-47769. See article

Oct 4, 2024 at 3:21 PM / National Vulnerability Database
Threat Intelligence Report

CVE-2024-47769 is a critical vulnerability in IDURAR's open source ERP CRM software, where an unauthenticated user can exploit the corePublicRouter.js file to append malicious payloads to SQL join statements, potentially allowing access to system files. The article does not provide information on a CVSS score, exploitation in the wild, proof-of-concept exploits, or available mitigations and patches. Additionally, there is no mention of downstream impacts to other third-party vendors or technologies. See article

Oct 4, 2024 at 3:21 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 4, 2024 at 3:22 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 11.2%)

Oct 5, 2024 at 10:04 AM
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Nov 13, 2024 at 6:11 PM
Static CVE Timeline Graph

Affected Systems

Idurarapp/idurar
+null more

Exploits

https://github.com/idurar/idurar-erp-crm/security/advisories/GHSA-948g-2vm7-mfv7
+null more

Patches

github.com
+null more

Attack Patterns

CAPEC-126: Path Traversal
+null more

References

CVE-2024-47769
High Severity Description IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location. Read more at https://www.tenable.com/cve/CVE-2024-47769
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath...
CVE-2024-47769
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location.
See 2 more references

News

CVE-2024-47769 Exploit
CVE Id : CVE-2024-47769 Published Date: 2024-11-13T15:12:00+00:00 IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location. inTheWild added a link to an exploit: https://github.com/idurar/idurar-erp-crm/security/advisories/GHSA-948g-2vm7-mfv7
CVE Alert: CVE-2024-47769
The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user.
CVE-2024-47769
The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location. Gravedad 3.1 (CVSS 3.1 Base Score)
NA - CVE-2024-47769 - IDURAR is open source ERP CRM accounting...
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is...
CVE-2024-47769
High Severity Description IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location. Read more at https://www.tenable.com/cve/CVE-2024-47769
See 6 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI