PT-2025-3677 · Advantive · Advantive Veracore

Published 2024-11-13 · Updated 2025-03-21 · CVE-2024-57968

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantive VeraCore versions prior to 2024.4.2.1

Description The issue allows remote authenticated users to upload files to unintended folders, such as those accessible during web browsing by other users. The "upload.aspx" endpoint can be used for this purpose. The XE Group has been exploiting this issue to target supply chains, dropping reverse shells, exfiltrating files, and modifying data. This exploit has been used in real-world attacks, with the group shifting from credit card data theft to more sophisticated supply chain attacks.

Recommendations For Advantive VeraCore versions prior to 2024.4.2.1, consider disabling the upload feature from the application as a temporary workaround until a patch is available. Restrict access to the "upload.aspx" endpoint to minimize the risk of exploitation. Additionally, removing the upload feature from the application can help mitigate the risk, as seen in the temporary fix released for on-prem customers.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-07171

CVE-2024-57968

Affected Products

Advantive Veracore

References · 44

• 🔥 https://solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days · Exploit
• 🔥 https://intezer.com/blog/research/xe-group-exploiting-zero-days · Exploit
• https://bdu.fstec.ru/vul/2025-07171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57968 · Security Note
• https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57968 · Vendor Advisory
• https://twitter.com/drumcryptochris/status/1888826038643220795 · Twitter Post
• https://twitter.com/syedaquib77/status/1901485696134828033 · Twitter Post
• https://t.me/cvenotify/114139 · Telegram Post
• https://twitter.com/shah_sheikh/status/1887180295197127115 · Twitter Post
• https://twitter.com/CrimEvader/status/1886508833096523875 · Twitter Post
• https://twitter.com/SOC_Prime/status/1889349081341849731 · Twitter Post
• https://twitter.com/CVETracker/status/1886867511330644048 · Twitter Post
• https://twitter.com/transilienceai/status/1892191695539744807 · Twitter Post
• https://twitter.com/ScyScan/status/1899220639455793500 · Twitter Post