CVE-2024-38449
📋 TL;DR
This CVE describes a directory traversal vulnerability in KasmVNC that allows authenticated remote attackers to access files and directories outside the intended application scope. Attackers can read sensitive files on the server, potentially exposing configuration data, credentials, or other confidential information. This affects KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and earlier versions.
💻 Affected Systems
- KasmVNC
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or credentials, leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Attackers with valid credentials can read files outside the VNC directory, potentially accessing application configuration, logs, or other sensitive data stored on the server.
If Mitigated
With proper network segmentation, strong authentication controls, and file system permissions, impact is limited to reading files accessible to the KasmVNC process user.
🎯 Exploit Status
Exploitation requires valid VNC credentials. The directory traversal can be performed through the file transfer feature using path traversal sequences like '../'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 or later (check for specific patched version)
Vendor Advisory: https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52
Restart Required: Yes
Instructions:
1. Update KasmVNC to the latest version. 2. Restart the KasmVNC service. 3. Verify the fix by testing directory traversal attempts.
🔧 Temporary Workarounds
Disable file transfer feature
allDisable the file transfer functionality in KasmVNC configuration to prevent exploitation of this vulnerability.
Edit KasmVNC configuration file and set 'FileTransfer' to 'false' or remove file transfer permissions.
Restrict VNC user permissions
linuxRun KasmVNC with a limited user account that has minimal file system access.
Create dedicated user for KasmVNC: 'sudo useradd -r -s /bin/false kasmvnc'
Run KasmVNC as this user: 'sudo -u kasmvnc kasmvnc_command'
🧯 If You Can't Patch
- Implement strict network access controls to limit VNC access to trusted IPs only.
- Use application-level firewalls to block directory traversal patterns in VNC traffic.
🔍 How to Verify
Check if Vulnerable:
Test if authenticated VNC sessions can access files outside the intended directory using path traversal sequences (e.g., '../../etc/passwd').Check Version:
kasmvnc --version or check the installed package version via system package managerVerify Fix Applied:
After patching, attempt the same directory traversal tests and verify they are blocked or return appropriate errors.📡 Detection & Monitoring
Log Indicators:
- Failed file access attempts with path traversal patterns
- Unusual file read operations from VNC user account
- Multiple '../' sequences in file transfer requests
Network Indicators:
- VNC traffic containing path traversal sequences in file transfer operations
- Unusual file read patterns over VNC protocol
SIEM Query:
source="kasmvnc.log" AND ("../" OR "..\\" OR "%2e%2e%2f")🔗 References
- https://github.com/kasmtech/KasmVNC/issues/254
- https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52
- https://kasmweb.com/kasmvnc
- https://github.com/kasmtech/KasmVNC/issues/254
- https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52
- https://kasmweb.com/kasmvnc
