CVE-2024-57170
📋 TL;DR
SOPlanning 1.53.00 has a directory traversal vulnerability in the upload.php file that allows authenticated attackers to delete arbitrary files by manipulating the 'fichier_to_delete' parameter with path traversal sequences like '../'. This affects all installations running the vulnerable version, potentially causing denial of service or application disruption.
💻 Affected Systems
- SOPlanning
📦 What is this software?
Soplanning by Soplanning
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise if critical system files are deleted, leading to OS instability, data loss, or permanent application unavailability.
Likely Case
Application disruption or denial of service through deletion of configuration files, user data, or application components.
If Mitigated
Limited impact if file permissions restrict deletion to non-critical application files only.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward with directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Monitor vendor for updates.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter directory traversal sequences from the 'fichier_to_delete' parameter.
Modify /process/upload.php to sanitize input using functions like realpath() or basename()
File Permission Restriction
linuxRestrict file deletion permissions to specific directories only.
chmod 755 /path/to/upload/directory
chown www-data:www-data /path/to/upload/directory
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block directory traversal patterns in requests.
- Restrict authenticated user access to only trusted users and implement strong authentication controls.
🔍 How to Verify
Check if Vulnerable:
Check if SOPlanning version is 1.53.00 and review /process/upload.php for lack of input validation on 'fichier_to_delete' parameter.Check Version:
Check SOPlanning configuration files or admin interface for version information.Verify Fix Applied:
Test if directory traversal sequences in 'fichier_to_delete' parameter are properly filtered or rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /process/upload.php with 'fichier_to_delete' parameter containing '../' sequences
- File deletion errors in application logs
Network Indicators:
- POST requests to upload.php with suspicious file paths
SIEM Query:
source="web_logs" AND uri="/process/upload.php" AND (param="fichier_to_delete" AND value="*../*")