CVE-2024-2055
📋 TL;DR
CVE-2024-2055 is an authentication bypass vulnerability in Artica Proxy's Rich Filemanager feature that allows unauthenticated attackers to access the file management interface running with root privileges. This affects Artica Proxy installations with the Rich Filemanager feature enabled, which is vulnerable by default configuration.
💻 Affected Systems
- Artica Proxy
📦 What is this software?
Artica Proxy by Articatech
Artica Proxy by Articatech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise: attackers gain root-level file system access, can read/modify/delete any file, install backdoors, or pivot to other systems.
Likely Case
Unauthorized file access and manipulation: attackers can view sensitive configuration files, steal credentials, or modify system files.
If Mitigated
Limited impact if authentication is enforced and feature is disabled or properly secured.
🎯 Exploit Status
Simple HTTP request to the Rich Filemanager endpoint without authentication is sufficient for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available; apply workarounds and disable vulnerable feature.
🔧 Temporary Workarounds
Disable Rich Filemanager
linuxCompletely disable the vulnerable Rich Filemanager feature in Artica Proxy configuration.
Edit Artica Proxy configuration to disable Rich Filemanager feature
Restart Artica Proxy service
Enable Authentication
linuxConfigure authentication requirement for Rich Filemanager interface if it must remain enabled.
Configure authentication in Artica Proxy settings for Rich Filemanager
🧯 If You Can't Patch
- Network segmentation: Isolate Artica Proxy from sensitive networks and systems
- Access controls: Restrict network access to Artica Proxy using firewalls or ACLs
🔍 How to Verify
Check if Vulnerable:
Check if Rich Filemanager is accessible without authentication by accessing the web interface endpoint.Check Version:
Check Artica Proxy version through web interface or configuration filesVerify Fix Applied:
Verify Rich Filemanager is either disabled or requires authentication to access.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to Rich Filemanager endpoints
- File operations from unauthenticated users
Network Indicators:
- HTTP requests to Rich Filemanager paths without authentication headers
SIEM Query:
web_access AND (uri CONTAINS 'filemanager' OR uri CONTAINS 'richfilemanager') AND auth_status='failed' OR auth_status IS NULL