CVE-2024-39937
📋 TL;DR
This vulnerability in supOS 5.0 allows attackers to perform directory traversal via the api/image/download endpoint, enabling unauthorized reading of files outside the intended directory. It affects all systems running supOS 5.0 with the vulnerable API endpoint exposed. Attackers can exploit this without authentication to access sensitive system files.
💻 Affected Systems
- supOS
📦 What is this software?
Supos by Supos
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading of configuration files, credentials, or sensitive data, potentially leading to lateral movement and full control of affected systems.
Likely Case
Unauthorized access to sensitive files including configuration files, logs, and potentially credentials stored in accessible directories.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires only HTTP requests with directory traversal sequences in the fileName parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://cloud.supos.com/announcement/detail?id=1985637965817671680
Restart Required: Yes
Instructions:
1. Check vendor advisory for latest patched version
2. Apply vendor-provided patch or update
3. Restart supOS services
4. Verify the fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock directory traversal sequences in the fileName parameter
WAF rule to block requests containing '../' in the fileName parameter
Network Access Control
allRestrict access to the vulnerable endpoint
Firewall rule to limit access to /api/image/download to trusted IPs only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate supOS from untrusted networks
- Deploy a web application firewall with rules to detect and block directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /api/image/download?fileName=../etc/passwd (or similar traversal) and checking if it returns unauthorized file contentsCheck Version:
Check supOS version through admin interface or system configurationVerify Fix Applied:
Attempt the same directory traversal request after patching; it should return an error or empty response instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api/image/download with '../' sequences in parameters
- Unusual file access patterns from the supOS application
Network Indicators:
- HTTP requests containing directory traversal sequences to the supOS API endpoint
SIEM Query:
source="web_logs" AND uri_path="/api/image/download" AND (query_string="*../*" OR user_agent="*scanner*")