CVE-2024-54452

Vulnerability

Overview

The vulnerability is a directory traversal and local file inclusion flaw in the logsSys.do page of Kurmi Provisioning Suite. The page fails to properly validate user-supplied paths, allowing an authenticated administrator to navigate the filesystem and include arbitrary files [2].

Exploitation

An attacker must first authenticate as an administrator to the Kurmi Provisioning Suite. Once authenticated, they can craft a malicious request to the logsSys.do endpoint with a path traversal sequence (e.g., ../) to read files outside the intended log directory. No additional privileges are required beyond admin access [2].

Impact

Successful exploitation enables the attacker to read any file accessible to the Kurmi user account on the server. This includes sensitive configuration files that may contain database passwords, LDAP credentials, or other secrets, leading to further compromise of the system [2].

Mitigation

Kurmi Software has released patched versions 7.9.0.35 and 7.10.0.18 to address this issue. Users are advised to upgrade immediately. No workarounds have been published [2].