CVE-2024-27630
📋 TL;DR
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in GNU Savane that allows remote attackers to delete arbitrary files on the server. Attackers can exploit this by sending crafted input to the trackers_data_delete_file function. All users running GNU Savane version 3.12 and earlier are affected.
💻 Affected Systems
- GNU Savane
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or privilege escalation.
Likely Case
Unauthorized deletion of application files, configuration files, or user data causing service disruption and data loss.
If Mitigated
Limited impact with proper file permissions and access controls preventing deletion of critical system files.
🎯 Exploit Status
Exploitation requires access to the vulnerable function but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.13 or later
Vendor Advisory: https://savannah.gnu.org/
Restart Required: Yes
Instructions:
1. Backup your Savane installation and database. 2. Download the latest version from the official repository. 3. Replace the vulnerable files with patched versions. 4. Restart the Savane service.
🔧 Temporary Workarounds
Restrict file deletion permissions
linuxModify file system permissions to prevent the Savane process from deleting critical files.
chmod -R 644 /path/to/savane/files
chown -R root:root /path/to/savane/files
Disable vulnerable function
allTemporarily disable or restrict access to the trackers_data_delete_file function.
# Comment out or remove function calls in relevant PHP files
🧯 If You Can't Patch
- Implement strict access controls and authentication for all file deletion operations.
- Deploy web application firewall (WAF) rules to block malicious file deletion requests.
🔍 How to Verify
Check if Vulnerable:
Check your Savane version and compare against vulnerable versions (3.12 and earlier).Check Version:
grep 'version' /path/to/savane/include/version.phpVerify Fix Applied:
Verify installation of Savane v3.13 or later and test file deletion functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in application logs
- Multiple failed deletion attempts
- Requests to trackers_data_delete_file with unusual parameters
Network Indicators:
- HTTP POST requests to file deletion endpoints with crafted parameters
- Unusual traffic patterns to Savane file management functions
SIEM Query:
source="savane_logs" AND (event="file_deletion" OR uri="/trackers_data_delete_file")