CVE-2024-27120
📋 TL;DR
CVE-2024-27120 is a Local File Inclusion vulnerability in ComfortKey software from Celsius Benelux that allows unauthenticated attackers to read sensitive files on the system. This affects organizations using vulnerable versions of ComfortKey. The vulnerability has been fixed in version 24.1.2.
💻 Affected Systems
- Celsius Benelux ComfortKey
📦 What is this software?
Comfortkey by Celsiusbenelux
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files including configuration files, credentials, and other confidential data, potentially leading to full system compromise.
Likely Case
Attackers exfiltrate configuration files, user data, and other sensitive information from the system.
If Mitigated
With proper network segmentation and access controls, impact is limited to the affected ComfortKey instance only.
🎯 Exploit Status
The vulnerability requires no authentication and exploitation is straightforward once the attack vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.1.2
Vendor Advisory: https://csirt.divd.nl/CVE-2024-27120
Restart Required: Yes
Instructions:
1. Download ComfortKey version 24.1.2 from official Celsius Benelux sources. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the ComfortKey service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to ComfortKey to only trusted IP addresses and networks.
Web Application Firewall
allImplement WAF rules to block LFI attack patterns and path traversal attempts.
🧯 If You Can't Patch
- Isolate the ComfortKey system from untrusted networks and internet access
- Implement strict file system permissions to limit what files ComfortKey can access
🔍 How to Verify
Check if Vulnerable:
Check the ComfortKey version number in the application interface or configuration files. If version is below 24.1.2, the system is vulnerable.Check Version:
Check ComfortKey web interface or consult application documentation for version checking method.Verify Fix Applied:
After updating, verify the version shows 24.1.2 or higher in the application interface or configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in ComfortKey logs
- Multiple failed file access attempts
- Requests containing path traversal sequences (../, ..\)
Network Indicators:
- HTTP requests with file path parameters to ComfortKey
- Unusual outbound data transfers from ComfortKey system
SIEM Query:
source="comfortkey" AND (uri="*../*" OR uri="*..\\*" OR uri="*/etc/*" OR uri="*/windows/*")