CVE-2024-24756
📋 TL;DR
CVE-2024-24756 is a path traversal vulnerability in Crafatar that allows attackers to read files outside the intended public directory. Affected systems include self-hosted Crafatar instances using vulnerable Docker containers, while instances behind Cloudflare or using the crafatar.com service are not affected. The vulnerability allows reading any file within the container filesystem.
💻 Affected Systems
- Crafatar
📦 What is this software?
Crafatar by Crafatar
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files within the container, potentially exposing configuration files, secrets, or application source code that might contain hardcoded credentials.
Likely Case
Attackers can read non-confidential application files that are already publicly available in the repository, causing minimal actual damage but demonstrating vulnerability.
If Mitigated
With proper network segmentation and Cloudflare protection, the vulnerability is effectively neutralized as external attackers cannot reach the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires direct access to vulnerable endpoint. The advisory includes code references showing the vulnerable path handling logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5
Vendor Advisory: https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2
Restart Required: Yes
Instructions:
1. Update Crafatar to version 2.1.5 or later. 2. Pull the latest Docker image if using container. 3. Restart the Crafatar service. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Deploy behind Cloudflare
allPlace Crafatar instance behind Cloudflare proxy to block direct access to vulnerable endpoint
Network segmentation
linuxRestrict network access to Crafatar instance using firewall rules
iptables -A INPUT -p tcp --dport [CRAFATAR_PORT] -s [ALLOWED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [CRAFATAR_PORT] -j DROP
🧯 If You Can't Patch
- Deploy instance behind Cloudflare or reverse proxy with path validation
- Implement strict network access controls to limit who can reach the Crafatar service
🔍 How to Verify
Check if Vulnerable:
Check if running Crafatar version earlier than 2.1.5 and accessible without Cloudflare protectionCheck Version:
docker exec [container_name] node -e "console.log(require('/app/package.json').version)"Verify Fix Applied:
Confirm version is 2.1.5 or later and test path traversal attempts return appropriate errors📡 Detection & Monitoring
Log Indicators:
- Unusual file path requests containing '../' sequences
- Requests for non-avatar files or files outside expected paths
Network Indicators:
- HTTP requests with path traversal sequences (../) to Crafatar endpoints
SIEM Query:
source="crafatar.logs" AND (url="*../*" OR url="*/../*")🔗 References
- https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67
- https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373
- https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2
- https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67
- https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373
- https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2
