CVE-2024-54453

Vulnerability Description

The Kurmi Provisioning Suite contains a path traversal vulnerability in the DocServlet servlet. The issue is present in versions before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. By crafting a request with directory traversal sequences, a remote attacker can read any file within the Kurmi web application installation folder [2].

Exploitation

Exploitation does not require authentication because the DocServlet can be accessed from the network. An attacker only needs to send a specially crafted HTTP request to the server. The vulnerability lies in improper input validation, allowing the path to leave the intended directory [2].

Impact

Successful exploitation allows the attacker to retrieve sensitive files from the installation directory. This includes obfuscated or compiled Kurmi source code, configuration files, or any other file stored under the web application root. Exposed source code can reveal business logic, API keys, or further security weaknesses [2].

Mitigation

Kurmi Software has fixed the vulnerability in version 7.9.0.35, 7.10.0.18, and 7.11.0.15. Users should upgrade to these or later releases. The advisory with patch details is available on the vendor's site [2].