CVE-2020-24381
📋 TL;DR
This vulnerability in GUnet Open eClass Platform allows remote attackers to access students' submitted assessments due to improper directory listing restrictions. The web server fails to block directory listings, exposing sensitive data directories within the web root. All installations using versions before 3.11 with default configurations are affected.
💻 Affected Systems
- GUnet Open eClass Platform (openeclass)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could download all student submissions, potentially exposing sensitive academic work, personal information, and assessment data, leading to academic integrity breaches and privacy violations.
Likely Case
Unauthorized access to student submissions and assessment files, potentially enabling cheating, data theft, or manipulation of academic records.
If Mitigated
With proper directory listing restrictions and access controls, the exposure would be limited to authorized users only.
🎯 Exploit Status
Exploitation requires only web browser access to directory listings; no authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11 and later
Vendor Advisory: https://github.com/gunet/openeclass/issues/39
Restart Required: No
Instructions:
1. Upgrade to Open eClass version 3.11 or later. 2. Verify the data directory is properly secured. 3. Test that directory listings are blocked.
🔧 Temporary Workarounds
Disable Directory Listings
allConfigure web server to block directory listings for sensitive directories
For Apache: add 'Options -Indexes' to .htaccess or virtual host config
For Nginx: add 'autoindex off;' to server block
Move Data Directory
allRelocate data directory outside web root
Move data directory to non-web-accessible location
Update application configuration to point to new location
🧯 If You Can't Patch
- Implement strict web server configuration to disable directory listings
- Move sensitive data directories outside the web root and update application paths
🔍 How to Verify
Check if Vulnerable:
Access the data directory URL (e.g., http://[host]/openeclass/data/) and check if directory listing is enabled and shows filesCheck Version:
Check version in admin panel or read application version filesVerify Fix Applied:
Attempt to access data directory URL and verify '403 Forbidden' or similar error appears instead of directory listing📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to data directory paths
- Unusual access patterns to /data/ directory
Network Indicators:
- HTTP requests to /data/ paths from unauthorized IPs
- Directory traversal attempts
SIEM Query:
web_access_logs status=200 AND uri_path CONTAINS '/data/'