CVE-2024-11239
📋 TL;DR
This critical vulnerability in Landray EKP allows remote attackers to perform path traversal attacks via the deleteFile API endpoint. Attackers can delete arbitrary files on the server by manipulating the 'folder' parameter. All Landray EKP installations up to version 16.0 are affected.
💻 Affected Systems
- Landray EKP
📦 What is this software?
Landray Ekp by Landray
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, configuration files, or application data leading to service disruption, data loss, or privilege escalation.
Likely Case
Unauthorized deletion of application files leading to service disruption, data loss, or defacement of the EKP system.
If Mitigated
Limited impact with proper file permission restrictions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub repositories. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Landray for updates or consider upgrading to versions beyond 16.0 if available.
🔧 Temporary Workarounds
Block vulnerable endpoint
linuxBlock access to the vulnerable API endpoint using web application firewall or network filtering
iptables -A INPUT -p tcp --dport 80 -m string --string "/sys/common/import.do?method=deleteFile" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/sys/common/import.do?method=deleteFile" --algo bm -j DROP
Restrict file permissions
linuxSet restrictive permissions on application directories to limit damage from file deletion
chmod 750 /path/to/landray/ekp/directories
chown root:root /path/to/landray/ekp/directories
🧯 If You Can't Patch
- Implement strict network segmentation to isolate EKP systems from critical infrastructure
- Deploy web application firewall with path traversal detection rules and block the specific vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test if the endpoint /sys/common/import.do?method=deleteFile accepts path traversal sequences in the 'folder' parameterCheck Version:
Check Landray EKP version in administration panel or configuration filesVerify Fix Applied:
Verify the endpoint no longer accepts path traversal sequences or is properly blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /sys/common/import.do?method=deleteFile with unusual folder parameters
- File deletion events in system logs from web application user
Network Indicators:
- HTTP requests containing path traversal sequences (../) to the vulnerable endpoint
- Unusual patterns of file deletion API calls
SIEM Query:
source="web_access_logs" AND uri="/sys/common/import.do?method=deleteFile" AND (folder="*../*" OR folder="*..\\*" OR folder="*%2e%2e%2f*")