CVE-2024-38432
📋 TL;DR
Matrix Tafnit v8 is vulnerable to file extension manipulation attacks due to improper validation of externally-supplied file names. This allows attackers to potentially bypass security controls by uploading malicious files with crafted extensions. Organizations using Matrix Tafnit v8 are affected.
💻 Affected Systems
- Matrix Tafnit
📦 What is this software?
Tafnit by Matrix Globalservices
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or complete system compromise if malicious files are executed with system privileges
Likely Case
Unauthorized file upload leading to data leakage, denial of service, or limited system access
If Mitigated
File uploads blocked or properly validated, limiting impact to failed upload attempts
🎯 Exploit Status
Exploitation requires access to file upload functionality
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.gov.il/en/Departments/faq/cve_advisories
Restart Required: Yes
Instructions:
1. Review vendor advisory at provided URL
2. Download and apply the latest patch from Matrix Tafnit vendor
3. Restart affected services
4. Verify patch application
🔧 Temporary Workarounds
Implement file extension validation
allAdd server-side validation to reject files with unexpected extensions
Restrict file upload permissions
allLimit file upload functionality to authenticated users only
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious file uploads
- Disable file upload functionality if not required for business operations
🔍 How to Verify
Check if Vulnerable:
Check if running Matrix Tafnit v8 and review file upload validation mechanismsCheck Version:
Check application version through admin interface or configuration filesVerify Fix Applied:
Test file upload with various extensions to ensure proper validation📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts
- Uploads with unusual file extensions
Network Indicators:
- Unusual file upload patterns
- Large number of file upload requests
SIEM Query:
source="tafnit_logs" AND (event="file_upload" AND extension NOT IN ("allowed_extensions"))