CVE-2024-40348
📋 TL;DR
This vulnerability in Bazaar v1.4.3 allows unauthenticated attackers to perform directory traversal attacks via the /api/swaggerui/static component. Attackers can potentially access sensitive files outside the intended directory structure. Any system running the vulnerable version with the API exposed is affected.
💻 Affected Systems
- Bazaar
📦 What is this software?
Bazarr by Bazarr
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like configuration files, credentials, or SSH keys, potentially leading to lateral movement or data exfiltration.
Likely Case
Unauthorized access to application files, configuration data, or other sensitive information stored on the server filesystem.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Proof of concept available in GitHub repository. Simple HTTP requests with crafted filenames can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check for updates from Bazaar developers or consider workarounds.
🔧 Temporary Workarounds
Block API Endpoint
allRestrict access to the vulnerable /api/swaggerui/static endpoint using web server configuration or firewall rules.
# For nginx: location /api/swaggerui/static { deny all; }
# For Apache: <Location /api/swaggerui/static> Require all denied </Location>
Input Validation
allImplement server-side validation to reject filename parameters containing directory traversal sequences (../, ..\)
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Bazaar API
- Deploy a web application firewall (WAF) with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test by sending HTTP requests to /api/swaggerui/static with filename parameters containing ../ sequences and observing if files outside the intended directory are accessed.Check Version:
Check Bazaar version in application configuration or via package manager: dpkg -l | grep bazaar or rpm -qa | grep bazaarVerify Fix Applied:
Attempt the same directory traversal tests after applying workarounds to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api/swaggerui/static with ../ sequences in parameters
- Unusual file access patterns from the Bazaar application
Network Indicators:
- HTTP requests containing directory traversal patterns (../, ..\) in URL parameters
SIEM Query:
source="web_logs" AND url="/api/swaggerui/static" AND (url="*../*" OR parameters="*../*")