CVE-2024-0113 Overview
CVE-2024-0113 is a path traversal vulnerability affecting the web management interface of NVIDIA Mellanox OS (MLNX-OS), ONYX, MLNX-GW, Skyway, and MetroX-3 XCC products. The flaw resides in the Common Gateway Interface (CGI) handling logic, where a specially crafted Uniform Resource Identifier (URI) allows an attacker to traverse outside the intended directory scope. Successful exploitation can result in privilege escalation and information disclosure across affected switch and gateway appliances. The weakness is categorized under [CWE-22] Path Traversal and [CWE-35] Path Traversal with relative ../ sequences.
Critical Impact
A network-adjacent attacker can issue a crafted CGI request to read sensitive files, escalate privileges, and compromise the confidentiality, integrity, and availability of NVIDIA networking appliances.
Affected Products
- NVIDIA Mellanox OS (mlnx-os) and MLNX-GW (mlnx-gw) LTS and current branches
- NVIDIA ONYX (onyx) and NVDA-OS XC (nvda-os_xc) network operating systems
- NVIDIA Skyway (mga100-hs2) and MetroX-3 XCC hardware platforms (mtq8400-hs2r, tq8100-hs2f, tq8200-hs2f)
Discovery Timeline
- 2024-08-12 - CVE-2024-0113 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0113
Vulnerability Analysis
The vulnerability exists in the web support component of multiple NVIDIA networking operating systems and appliances. The CGI handler accepts URI input without enforcing canonical path normalization. An attacker submits a crafted URI containing directory traversal sequences to reference files outside the web server document root. The result is unauthorized access to filesystem resources and CGI endpoints that should not be reachable.
Exploitation requires network access to the management web interface and user interaction, such as an authenticated administrator visiting a malicious link or processing an attacker-supplied request. Successful exploitation impacts confidentiality, integrity, and availability of the appliance, and may enable escalation to higher-privileged operations exposed by internal CGI scripts.
Root Cause
The root cause is insufficient input validation of URI path components passed to CGI scripts. The web layer does not strip or reject relative path elements such as ../, nor does it confirm that resolved paths remain within the intended CGI directory. This deficiency aligns with [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and [CWE-35] (Path Traversal: .../...//).
Attack Vector
The attack vector is the network-facing management web interface. An attacker crafts an HTTP request whose URI embeds traversal sequences targeting privileged CGI endpoints or sensitive configuration files. Because the flaw requires user interaction, attackers commonly chain it with phishing or cross-site request forgery to coerce an administrator session into issuing the request. Specific exploitation details are described in the NVIDIA Support Response.
Detection Methods for CVE-2024-0113
Indicators of Compromise
- HTTP requests to the appliance management interface containing ../, ..%2f, or other encoded traversal sequences in CGI URIs.
- Web server access logs showing CGI invocations referencing files outside the standard web root, such as /etc/, /var/, or operating system configuration paths.
- Unexpected privileged actions or configuration changes following requests to web CGI endpoints.
Detection Strategies
- Inspect appliance HTTP access logs for URI patterns matching path traversal payloads against CGI handlers.
- Deploy network IDS or web application firewall signatures that flag traversal sequences and double-encoded variants in management plane traffic.
- Correlate administrator session activity with anomalous CGI access to identify cross-site request forgery chains.
Monitoring Recommendations
- Forward management interface logs from MLNX-OS, ONYX, MLNX-GW, and MetroX-3 devices to a centralized log analytics platform for retention and search.
- Alert on authentication state changes, privilege elevations, and configuration writes originating from the web interface.
- Restrict and monitor source IP ranges permitted to reach the appliance management network to limit exposure.
How to Mitigate CVE-2024-0113
Immediate Actions Required
- Identify all affected NVIDIA Mellanox OS, ONYX, MLNX-GW, Skyway, and MetroX-3 XCC devices in the environment and inventory their firmware versions.
- Apply the firmware updates referenced in the NVIDIA Support Response as a priority.
- Restrict access to the appliance web management interface to dedicated administrative networks and bastion hosts only.
- Require administrators to log out of the web interface after use and avoid clicking untrusted links while authenticated.
Patch Information
NVIDIA published fixed firmware versions for MLNX-OS, ONYX, MLNX-GW, Skyway, and MetroX-3 XCC products. Refer to the NVIDIA Support Response for the specific patched releases and upgrade guidance for each platform and branch.
Workarounds
- Disable the web management interface where command-line or out-of-band management is sufficient.
- Place management interfaces behind a VPN or jump host and enforce strict access control lists on the management VLAN.
- Deploy a web application firewall in front of the management interface to block requests containing path traversal sequences until patches are applied.
# Example ACL restricting web management access to a single admin subnet
# Apply on the upstream router or firewall protecting the management VLAN
access-list MGMT_WEB permit tcp 10.10.0.0/24 host <appliance-mgmt-ip> eq 443
access-list MGMT_WEB deny tcp any host <appliance-mgmt-ip> eq 443
access-list MGMT_WEB deny tcp any host <appliance-mgmt-ip> eq 80
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
