CVE-2024-1005: NODERP Information Disclosure Flaw

CVE-2024-1005 Overview

CVE-2024-1005 is a files or directories accessibility vulnerability [CWE-552] affecting Shanxi Diankeyun Technology NODERP versions up to 6.0.2. The flaw resides in unknown code of the /runtime/log endpoint, which exposes log files or directories to unauthenticated remote parties. Attackers can manipulate requests to access sensitive resources without authentication or user interaction. The vulnerability was publicly disclosed with proof-of-concept details available, and the vendor did not respond to disclosure attempts. NODERP is an enterprise resource planning (ERP) platform, making any log exposure a potential source of business-sensitive data leakage.

Critical Impact
Unauthenticated remote attackers can access log files via the /runtime/log path, exposing application internals and potentially sensitive operational data without any authentication.

Affected Products

Shanxi Diankeyun Technology NODERP versions up to and including 6.0.2
Deployments exposing the /runtime/log path to untrusted networks
ERP environments running unpatched NODERP instances

Discovery Timeline

2024-01-29 - CVE-2024-1005 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1005

Vulnerability Analysis

The vulnerability is categorized under [CWE-552]: Files or Directories Accessible to External Parties. NODERP exposes the /runtime/log path without enforcing authentication or access controls. Remote attackers can issue HTTP requests directly to this path and retrieve log data intended to remain internal. The attack vector is network-based, requires no privileges, and needs no user interaction, which makes opportunistic scanning and exploitation straightforward. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.914% with a percentile of 55.6, indicating moderate likelihood of exploitation activity.

Root Cause

The root cause is missing access control on the /runtime/log resource within the NODERP web application. The application treats log files as publicly reachable content rather than restricting them to administrative users. No authentication challenge, role check, or path normalization protects the directory. The vendor did not issue a patch, and no upstream fix is documented in the advisory data.

Attack Vector

Exploitation requires only network access to the NODERP web interface. An attacker sends an unauthenticated HTTP request to the /runtime/log path on a vulnerable host. The server returns log file contents or directory listings depending on configuration. The disclosed log data may contain stack traces, request parameters, internal hostnames, session identifiers, or database query fragments useful for follow-on attacks.

No verified exploit code is referenced in the structured advisory data. Technical details and a public write-up are available at the Zhao Jin Note Sharing disclosure and VulDB entry 252274.

Detection Methods for CVE-2024-1005

Indicators of Compromise

HTTP GET requests to the /runtime/log path or sub-paths from external IP addresses
Successful HTTP 200 responses returning log file content or directory index pages from NODERP servers
Repeated requests enumerating filenames under /runtime/log consistent with automated scanning
User-Agent strings associated with vulnerability scanners targeting Chinese ERP applications

Detection Strategies

Inspect web server and reverse proxy access logs for unauthenticated requests to /runtime/log
Deploy web application firewall (WAF) rules that block external access to /runtime/ paths on NODERP hosts
Correlate request patterns across multiple log filenames to identify directory enumeration attempts
Use network detection rules to flag responses containing log markers such as stack traces returned over HTTP

Monitoring Recommendations

Alert on any HTTP 200 response to /runtime/log* originating from outside trusted administrative networks
Monitor outbound data volume from NODERP servers for spikes consistent with bulk log exfiltration
Track new external IPs probing ERP application paths and review them against threat intelligence feeds
Review file access auditing on the NODERP host filesystem for unexpected reads of log directories by the web service account

How to Mitigate CVE-2024-1005

Immediate Actions Required

Restrict access to the /runtime/log path at the reverse proxy or WAF layer, denying all non-administrative source addresses
Remove direct internet exposure of NODERP management interfaces and place the application behind a VPN or zero-trust gateway
Rotate any credentials, tokens, or session identifiers that may have appeared in exposed log files
Audit existing log files for sensitive content and remove or sanitize records that should not be retained

Patch Information

The vendor was contacted regarding this disclosure but did not respond, and no official patch is documented in the advisory data. Organizations running NODERP up to 6.0.2 should treat the product as unpatched and apply compensating controls. Monitor the VulDB advisory for any future vendor updates.

Workarounds

Configure the upstream web server (Nginx, Apache, or equivalent) to return HTTP 403 for any request matching /runtime/log or /runtime/
Enforce IP allowlisting so only internal administrative subnets can reach NODERP HTTP endpoints
Disable verbose logging or redirect logs to a location outside the web root if the application supports it
Consider migrating off NODERP if the vendor remains unresponsive to security disclosures

bash

# Nginx configuration example to block external access to /runtime/log
location ^~ /runtime/ {
    allow 10.0.0.0/8;       # internal admin network
    deny  all;
    return 403;
}