CVE-2024-33863
📋 TL;DR
This vulnerability allows attackers to perform local file inclusion via the /api/Cdn/GetFile endpoint in linqi on Windows systems. Attackers can read arbitrary files from the server, potentially exposing sensitive data. All Windows installations of linqi before version 1.4.0.1 are affected.
💻 Affected Systems
- linqi
📦 What is this software?
Linqi by Linqi
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, credentials, or using file inclusion to execute arbitrary code.
Likely Case
Unauthorized access to sensitive files containing configuration data, credentials, or user information.
If Mitigated
Limited file access if proper file permissions and web server restrictions are in place.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication via simple HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0.1
Vendor Advisory: https://linqi.help/Updates/en#/SecurityUpdates
Restart Required: Yes
Instructions:
1. Download linqi version 1.4.0.1 or later from official sources. 2. Stop the linqi service. 3. Backup current installation. 4. Install the updated version. 5. Restart the linqi service.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or reverse proxy to block access to /api/Cdn/GetFile endpoint
# Example nginx config: location /api/Cdn/GetFile { deny all; }
# Example Apache config: <Location /api/Cdn/GetFile> Require all denied </Location>
Restrict file system permissions
windowsLimit the linqi service account to only necessary directories
icacls C:\linqi\ /grant "linqi-service-account":(OI)(CI)RX
icacls C:\ /deny "linqi-service-account":(OI)(CI)F
🧯 If You Can't Patch
- Implement network segmentation to isolate linqi servers from sensitive systems
- Deploy web application firewall with specific rules to block file inclusion patterns
🔍 How to Verify
Check if Vulnerable:
Check if linqi version is below 1.4.0.1 on Windows and test if /api/Cdn/GetFile endpoint accepts file path parametersCheck Version:
Check linqi web interface or configuration files for version informationVerify Fix Applied:
Verify linqi version is 1.4.0.1 or higher and test that /api/Cdn/GetFile endpoint no longer accepts arbitrary file paths📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api/Cdn/GetFile with file path parameters
- Unusual file access patterns from linqi process
Network Indicators:
- HTTP requests containing path traversal sequences (../, ..\) to /api/Cdn/GetFile
SIEM Query:
source="linqi-logs" AND uri="/api/Cdn/GetFile" AND (uri="*../*" OR uri="*..\\*")