CVE-2024-46898
📋 TL;DR
SHIRASAGI CMS versions before 1.19.1 have a path traversal vulnerability that allows attackers to read arbitrary files on the server by sending specially crafted HTTP requests. This affects all SHIRASAGI installations running vulnerable versions. Attackers can potentially access sensitive configuration files, source code, or other protected data.
💻 Affected Systems
- SHIRASAGI CMS
📦 What is this software?
Shirasagi by Ss Proj
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through retrieval of sensitive files like configuration files containing database credentials, SSH keys, or other authentication secrets, leading to further system exploitation.
Likely Case
Unauthorized access to sensitive files containing application configuration, user data, or system information that could facilitate additional attacks.
If Mitigated
Limited file access restricted by file permissions and directory structures, with no critical credentials exposed.
🎯 Exploit Status
The vulnerability requires crafting HTTP requests with path traversal sequences. No authentication is required to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.19.1
Vendor Advisory: https://www.ss-proj.org/
Restart Required: Yes
Instructions:
1. Backup your SHIRASAGI installation and database. 2. Update to SHIRASAGI v1.19.1 or later using git pull or package update. 3. Restart the application server. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block path traversal patterns in URLs
File Permission Restrictions
linuxRestrict file system permissions to limit accessible directories
chmod 750 /path/to/shirasagi/files
chown www-data:www-data /path/to/shirasagi
🧯 If You Can't Patch
- Implement strict input validation to reject URLs containing path traversal sequences (../, ..\)
- Deploy a reverse proxy or WAF with rules to detect and block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check if SHIRASAGI version is below 1.19.1 by examining the application version in admin panel or checking gemfile.lockCheck Version:
grep -r 'shirasagi' Gemfile.lock | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
After updating, verify version is 1.19.1 or higher and test that path traversal attempts return proper error responses📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ or ..\ sequences
- Unusual file access patterns in application logs
- 404 errors for files that shouldn't be accessible
Network Indicators:
- HTTP requests with encoded path traversal sequences (%2e%2e%2f)
- Multiple failed file access attempts from single IP
SIEM Query:
source="web_logs" AND (url="*../*" OR url="*..\\*" OR url="*%2e%2e%2f*")