CVE-2024-12643: tbm-client Path Traversal Vulnerability

CVE-2024-12643 Overview

CVE-2024-12643 affects the tbm-client application from Chunghwa Telecom. The application starts a local web server and exposes APIs that communicate with a target website. These APIs lack Cross-Site Request Forgery (CSRF) protection, so unauthenticated remote attackers can invoke them through phishing pages. One of the exposed APIs also contains an Absolute Path Traversal flaw [CWE-36], which lets attackers delete arbitrary files on the victim's system. Successful exploitation requires user interaction, typically by visiting a malicious page while the client runs locally.

Critical Impact
Remote attackers can delete arbitrary files on a victim's system through a phishing page, leading to integrity and availability loss on the host.

Affected Products

Chunghwa Telecom tbm-client
Local HTTP API endpoints exposed by tbm-client
Windows endpoints running the vulnerable client

Discovery Timeline

2024-12-16 - CVE-2024-12643 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2024-12643

Vulnerability Analysis

The tbm-client runs a lightweight HTTP server on the local machine and exposes APIs intended for communication with a designated remote website. The server does not validate the origin of incoming requests and does not implement CSRF tokens. Any web page loaded in the victim's browser can issue requests to the local listener while the client is running. One API accepts a file path parameter and passes it to a delete operation without normalization or allow-listing. Because the path is treated as an absolute path, attackers can target files outside any intended working directory. The combination of missing CSRF defenses and unsafe path handling converts a local utility into a remote file deletion primitive.

Root Cause

The root cause is twofold. First, the local API endpoints accept cross-origin requests without verifying an anti-CSRF token, the Origin header, or the Referer header. Second, the file deletion handler consumes a caller-supplied absolute path and does not constrain it to a safe directory, matching the pattern described by CWE-36: Absolute Path Traversal.

Attack Vector

An attacker hosts a phishing page that issues a forged request to the local tbm-client listener. When a victim visits the page, the browser sends the request to localhost. The vulnerable API receives an absolute path such as C:\Users\victim\Documents\report.docx and deletes the file. Repeated requests can remove configuration files, user data, or files required for system stability. The attack does not require credentials but does require the victim to load the attacker-controlled page while tbm-client is running. Refer to the TWCERT Security Report for vendor details.

Detection Methods for CVE-2024-12643

Indicators of Compromise

Outbound HTTP requests from a browser process to the tbm-client local listener port shortly after visiting an external page
File deletion events in user profile directories without a corresponding user action or process lineage tied to a known application
Unexpected loss of tbm-client configuration files, browser data, or Office documents after web browsing sessions

Detection Strategies

Monitor process telemetry for browser child processes issuing requests to 127.0.0.1 on the port used by tbm-client
Correlate file deletion events on Windows endpoints with preceding browser network activity to identify CSRF-driven deletions
Alert on HTTP requests to the local listener whose Origin or Referer header is an external domain rather than the expected Chunghwa Telecom website

Monitoring Recommendations

Enable file system auditing on user profile directories and critical application paths to capture delete events with the initiating process
Forward endpoint network telemetry and file events to a centralized data lake to support cross-event correlation
Track installation footprint of tbm-client across the estate so detections can be scoped to hosts actually exposed to the flaw

How to Mitigate CVE-2024-12643

Immediate Actions Required

Identify all endpoints running tbm-client and apply the vendor-supplied update referenced in the TWCERT advisory
Until patched, stop or uninstall the tbm-client service on hosts that do not require it for daily operations
Restrict outbound browser access to only required sites for users who must run the client, reducing phishing exposure

Patch Information

Chunghwa Telecom has acknowledged the issue through TWCERT. Administrators should consult the TWCERT Incident Report for the fixed version and deployment guidance. Apply the vendor update on every host running tbm-client.

Workarounds

Block the local listener port used by tbm-client from non-loopback sources and from browser child processes through host firewall rules
Disable autostart for tbm-client so the local API is not running during general web browsing
Train users to recognize phishing pages that solicit interaction with locally installed Chunghwa Telecom utilities

bash

# Example Windows host firewall rule to block external access to the local listener
# Replace <PORT> with the port used by tbm-client on the affected host
netsh advfirewall firewall add rule \
  name="Block tbm-client external" \
  dir=in \
  action=block \
  protocol=TCP \
  localport=<PORT> \
  remoteip=!127.0.0.1