PT-2024-33279 · Zimaos · Zimaos

Drdark1999 · Published 2024-10-24 · Updated 2024-11-06 · CVE-2024-48931

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZimaOS versions 1.2.4 and earlier

Description The issue concerns improper input validation in the ZimaOS API endpoint http://<Zima Server IP:PORT>/v3/file?token=<token>&files=<file path>, allowing authenticated users to read sensitive system files by manipulating the files parameter. This exposes critical system data, including password hashes in /etc/shadow, posing a high risk for privilege escalation or system compromise. The vulnerability stems from the lack of validation or restriction on file paths provided via the files parameter, enabling attackers to access sensitive files outside the intended directory.

Recommendations For ZimaOS versions 1.2.4 and earlier, as a temporary workaround, consider restricting access to the http://<Zima Server IP:PORT>/v3/file API endpoint until a patch is available. Avoid using the files parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-48931

GHSA-HJW2-9GQ5-QGWJ

Affected Products

Zimaos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48931.json · Exploit
• 🔥 https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-hjw2-9gq5-qgwj · Exploit
• 🔥 https://youtu.be/FyIfcmCyDXs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48931 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48931 · Vendor Advisory
• https://t.me/cvedetector/8855 · Telegram Post