6.5 CVE-2024-43451
CISA Kev Catalog Path Traversal Patch
NTLM Hash Disclosure Spoofing Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2024-43451
Categories
CWE-NVD-noinfo
CWE-73 : External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations. When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability. For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). Use OS-level permissions and run as a low-privileged user to limit the scope of any successful attack. If you are using PHP, configure your application so that it does not use register_globals. During implementation, develop your application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues. Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. Chain: a learning management tool debugger uses external input to locate previous session logs (CWE-73) and does not properly validate the given path (CWE-20), allowing for filesystem path traversal using "../" sequences (CWE-24) Chain: external control of values for user's desired language and theme enables path traversal. Chain: external control of user's target language enables remote file inclusion.
References
secure@microsoft.com Patch
CPE
| cpe |
start |
end |
| Configuration 1 |
| cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* |
|
< 10.0.10240.20826 |
| cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:* |
|
< 10.0.10240.20826 |
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* |
|
< 10.0.14393.7515 |
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* |
|
< 10.0.14393.7515 |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* |
|
< 10.0.17763.6532 |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* |
|
< 10.0.17763.6532 |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* |
|
< 10.0.19044.5131 |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* |
|
< 10.0.19044.5131 |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* |
|
< 10.0.19044.5131 |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* |
|
< 10.0.19045.5131 |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* |
|
< 10.0.19045.5131 |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* |
|
< 10.0.19045.5131 |
| cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:* |
|
< 10.0.22621.4460 |
| cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:* |
|
< 10.0.22621.4460 |
| cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* |
|
< 10.0.22631.4460 |
| cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* |
|
< 10.0.22631.4460 |
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* |
|
< 10.0.26100.2314 |
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* |
|
< 10.0.26100.2314 |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* |
|
|
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* |
|
|
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* |
|
|
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
|
|
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* |
|
|
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* |
|
< 10.0.14393.7515 |
| cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* |
|
< 10.0.17763.6532 |
| cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* |
|
< 10.0.20348.2849 |
| cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* |
|
< 10.0.25398.1251 |
| cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* |
|
< 10.0.26100.2314 |
REMEDIATION
Patch
EXPLOITS
Exploit-db.com
| id |
description |
date |
|
| No known exploits |
POC Github
Other Nist (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id |
description |
severity |
| 13 |
Subverting Environment Variable Values
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary. [Probe target application] The adversary first probes the target application to determine important information about the target. This information could include types software used, software versions, what user input the application consumes, and so on. Most importantly, the adversary tries to determine what environment variables might be used by the underlying software, or even the application itself. [Find user-controlled environment variables] Using the information found by probing the application, the adversary attempts to manipulate any user-controlled environment variables they have found are being used by the application, or suspect are being used by the application, and observe the effects of these changes. If the adversary notices any significant changes to the application, they will know that a certain environment variable is important to the application behavior and indicates a possible attack vector. [Manipulate user-controlled environment variables] The adversary manipulates the found environment variable(s) to abuse the normal flow of processes or to gain access to privileged resources. |
Very High |
| 267 |
Leverage Alternate Encoding
An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited. |
High |
| 64 |
Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc. The attacker accesses the server using a specific URL. The attacker tries to encode some special characters in the URL. The attacker find out that some characters are not filtered properly. The attacker crafts a malicious URL string request and sends it to the server. The server decodes and interprets the URL string. Unfortunately since the input filtering is not done properly, the special characters have harmful consequences. |
High |
| 72 |
URL Encoding
This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. [Survey web application for URLs with parameters] Using a browser, an automated tool or by inspecting the application, an adversary records all URLs that contain parameters. [Probe URLs to locate vulnerabilities] The adversary uses the URLs gathered in the "Explore" phase as a target list and tests parameters with different encodings of special characters to see how the web application will handle them. [Inject special characters into URL parameters] Using the information gathered in the "Experiment" phase, the adversary injects special characters into the URL using URL encoding. This can lead to path traversal, cross-site scripting, SQL injection, etc. |
High |
| 76 |
Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible. [Fingerprinting of the operating system] In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used. [Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user [Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of the targeted file or other file system control syntax to be passed to the application [Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.) |
Very High |
| 78 |
Using Escaped Slashes in Alternate Encoding
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and attempts to escape multiple different special characters using a backslash. [Manipulate input] Once the adversary determines how to bypass filters that filter out special characters using an escaped slash, they will manipulate the user input in a way that is not intended by the application. |
High |
| 79 |
Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and looks for areas where user input is used to access resources on the target host. The adversary attempts different encodings of slash characters to bypass input filters. [Traverse application directories] Once the adversary determines how to bypass filters that filter out slash characters, they will manipulate the user input to include slashes in order to traverse directories and access resources that are not intended for the user. |
High |
| 80 |
Using UTF-8 Encoding to Bypass Validation Logic
This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the RFC 3629, a particularly subtle form of this attack can be carried out against a parser which performs security-critical validity checks against the UTF-8 encoded form of its input, but interprets certain illegal octet sequences as characters. [Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application. [Probe entry points to locate vulnerabilities] The attacker uses the entry points gathered in the "Explore" phase as a target list and injects various UTF-8 encoded payloads to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited. |
High |
MITRE
Techniques
| id |
description |
| T1027 |
Obfuscated Files or Information |
| T1562.003 |
Impair Defenses:Impair Command History Logging |
| T1574.006 |
Hijack Execution Flow:Dynamic Linker Hijacking |
| T1574.007 |
Hijack Execution Flow:Path Interception by PATH Environment Variable |
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. |
Mitigations
| id |
description |
| T1027 |
Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software. |
| T1562.003 |
Make sure that the <code>HISTCONTROL</code> environment variable is set to “ignoredups” instead of “ignoreboth” or “ignorespace”. |
| T1574.006 |
When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions. Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary. |
| T1574.007 |
Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:Windows</code>, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories. |
| © 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation. |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
Discover this offer
