CVE-2024-46986
📋 TL;DR
CVE-2024-46986 is an arbitrary file write vulnerability in Camaleon CMS that allows authenticated users to write files to any location on the web server. This can lead to remote code execution if attackers write malicious Ruby files to the Rails initializers folder. All Camaleon CMS installations before version 2.8.2 are affected.
💻 Affected Systems
- Camaleon CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution leading to data theft, lateral movement, and complete system control.
Likely Case
Webshell deployment leading to data exfiltration, defacement, or cryptocurrency mining.
If Mitigated
Limited file system damage if proper file permissions restrict write access to critical directories.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. Path traversal techniques can be used to write files to arbitrary locations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.2
Vendor Advisory: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5
Restart Required: Yes
Instructions:
1. Backup your Camaleon CMS installation and database. 2. Update Gemfile to specify 'gem "camaleon_cms", "~> 2.8.2"'. 3. Run 'bundle update camaleon_cms'. 4. Restart the Rails application server.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict file system permissions to prevent writing to config/initializers/ and other sensitive directories
- Implement strict access controls and monitor for suspicious file upload activities
🔍 How to Verify
Check if Vulnerable:
Check Camaleon CMS version in Gemfile.lock or via Rails console: CamaleonCms::VERSIONCheck Version:
grep -A1 "camaleon_cms" Gemfile.lock | grep versionVerify Fix Applied:
Verify version is 2.8.2 or higher and test file upload functionality with path traversal attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Path traversal strings in upload requests
- File writes to config/initializers/ directory
Network Indicators:
- POST requests to media upload endpoints with directory traversal payloads
SIEM Query:
source="web_logs" AND (uri_path="/admin/media/upload" OR uri_path="/media/upload") AND (request_body CONTAINS "../" OR request_body CONTAINS "..\\")🔗 References
- https://codeql.github.com/codeql-query-help/ruby/rb-path-injection
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5
- https://owasp.org/www-community/attacks/Path_Traversal
- https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS
- https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
