PT-2024-5771 · Traccar · Traccar

Nvn1729 · Published 2024-04-10 · Updated 2025-01-09 · CVE-2024-31214

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Traccar versions 5.1 through 5.12

Description The issue allows arbitrary files to be uploaded through the device image upload API, giving attackers full control over the file contents, directory, and extension, and partial control over the file name. This can potentially lead to remote code execution, XSS, and DOS. The default installation of Traccar, with self-registration enabled and running with root/system privileges, makes this issue more severe.

Recommendations For Traccar versions 5.1 through 5.12, update to version 6.0 to resolve the issue. As a temporary workaround, consider turning off self-registration to reduce the severity of the vulnerability. Restrict access to the device image upload API to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2024-06484

CVE-2024-31214

GHSA-3GXQ-F2QJ-C8V9

Affected Products

Traccar

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/traccar_rce_upload.rb · Exploit
• 🔥 https://github.com/traccar/traccar/security/advisories/GHSA-3gxq-f2qj-c8v9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31214.json · Exploit
• https://github.com/traccar/traccar/commit/3fbdcd81566bc72e319ec05c77cf8a4120b87b8f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31214 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31214 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06484 · Security Note
• https://github.com/traccar/traccar/blob/master/src/main/java/org/traccar/model/Device.java#L56 · Note
• https://github.com/traccar/traccar/blob/v5.12/src/main/java/org/traccar/api/resource/DeviceResource.java#L191 · Note
• https://twitter.com/Horizon3ai/status/1828532965380342121 · Twitter Post
• https://twitter.com/XynikIT/status/1827982557306052960 · Twitter Post
• https://t.me/zerodayalert/314 · Telegram Post
• https://twitter.com/Horizon3Attack/status/1826990787227258956 · Twitter Post
• https://twitter.com/cyashadotcom/status/1828045987543384435 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1828345026008715628 · Twitter Post