CVE-2024-10200: Wellchoose Admin Path Traversal Flaw

CVE-2024-10200 Overview

CVE-2024-10200 is a path traversal vulnerability in the Wellchoose Administrative Management System. The flaw allows unauthenticated remote attackers to download arbitrary files from the server by manipulating file path parameters. The vulnerability is classified under [CWE-22] (Path Traversal) and [CWE-23] (Relative Path Traversal).

The issue requires no authentication, no user interaction, and is exploitable over the network. Successful exploitation results in disclosure of sensitive files including configuration data, credentials, and source code stored on the host.

Critical Impact
Unauthenticated remote attackers can download arbitrary files from the server, exposing sensitive system and application data.

Affected Products

Wellchoose Administrative Management System (all versions covered by cpe:2.3:a:wellchoose:administrative_management_system:-)
Deployments exposing the management interface to untrusted networks
Instances without vendor-supplied patches applied

Discovery Timeline

2024-10-21 - CVE-2024-10200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10200

Vulnerability Analysis

The Wellchoose Administrative Management System fails to properly sanitize file path parameters supplied through HTTP requests. An attacker can inject relative path sequences such as ../ to escape the intended directory and reference arbitrary locations on the host file system. Because the vulnerable endpoint does not require authentication, exploitation requires only network reachability to the application.

The impact is limited to confidentiality. Attackers can read files accessible to the web service account but cannot directly modify content or disrupt availability through this flaw alone. Disclosed files frequently include database credentials, session secrets, and internal configuration that enable follow-on attacks.

Root Cause

The root cause is insufficient input validation on a file-handling parameter. The application concatenates user-supplied input into a file path without canonicalizing the result or restricting access to an allowed base directory. This pattern matches the [CWE-23] relative path traversal weakness referenced in the advisory.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP request to the vulnerable download endpoint, supplying a parameter value containing traversal sequences such as ../../../../etc/passwd or Windows equivalents like ..\..\..\boot.ini. The server resolves the path and returns the file contents in the HTTP response.

The vulnerability is described in prose only; no verified public exploit code is referenced in the advisory. For technical details see the TW CERT Security Advisory and TW CERT Incident Report.

Detection Methods for CVE-2024-10200

Indicators of Compromise

HTTP requests containing traversal sequences such as ../, ..\, %2e%2e%2f, or %2e%2e%5c in query parameters or path segments
Web server access logs showing successful 200 responses to requests targeting sensitive system files (for example /etc/passwd, web.config, application.properties)
Unusual outbound transfer volumes from the Wellchoose application host to external IP addresses
Repeated download requests from a single source IP iterating through file names or directories

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for canonicalized path traversal patterns including URL-encoded and double-encoded variants
Correlate HTTP request URIs against a list of sensitive file paths to flag access attempts
Monitor file read operations performed by the Wellchoose service account for accesses outside the application's working directory

Monitoring Recommendations

Enable verbose access logging on the Wellchoose application and forward logs to a central SIEM for retention and analytics
Establish a baseline of expected file download activity and alert on deviations in volume or target paths
Conduct periodic authenticated and unauthenticated scans of the application using a vulnerability scanner with path traversal signatures

How to Mitigate CVE-2024-10200

Immediate Actions Required

Restrict network access to the Wellchoose Administrative Management System using firewall rules or VPN-only access until a vendor patch is applied
Review web server and application logs for prior exploitation attempts going back to before the publication date
Rotate credentials, API keys, and secrets stored in files reachable by the application service account
Contact Wellchoose or the local distributor for an official patched release of the Administrative Management System

Patch Information

No vendor advisory URL or fixed version identifier is provided in the NVD record at the time of publication. Customers should consult Wellchoose directly and reference the TW CERT Security Advisory for remediation guidance and updated release information.

Workarounds

Deploy a WAF rule that blocks requests containing path traversal sequences in any parameter, including URL-encoded forms (%2e%2e%2f, %2e%2e%5c)
Run the Wellchoose application under a least-privileged service account with read access restricted to required directories only
Apply file system access control lists (ACLs) to deny the service account read access to sensitive operating system and configuration files
Place the application behind a reverse proxy that normalizes URLs and rejects traversal patterns before forwarding requests

bash

# Example ModSecurity rule to block path traversal attempts
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)" \
    "id:1002001,phase:2,deny,status:403,log,\
    msg:'CVE-2024-10200 Path Traversal Attempt Blocked'"