CVE-2024-12645 Overview
CVE-2024-12645 is an arbitrary file read vulnerability in the topm-client application from Chunghwa Telecom. The application spawns a local web server that exposes application programming interfaces (APIs) for communicating with a target website. The APIs lack Cross-Site Request Forgery (CSRF) protection, and one endpoint contains a Relative Path Traversal weakness [CWE-23]. Unauthenticated remote attackers can chain these flaws through phishing to read arbitrary files from a victim's system. The vulnerability requires user interaction, typically luring the target to a malicious webpage that issues requests to the local API surface.
Critical Impact
Remote unauthenticated attackers can read arbitrary files from a victim's workstation by tricking the user into visiting an attacker-controlled page that abuses the unprotected local API.
Affected Products
- Chunghwa Telecom topm-client
- Local web server APIs bundled with the client
- Windows endpoints running the affected client software
Discovery Timeline
- 2024-12-16 - CVE-2024-12645 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12645
Vulnerability Analysis
The topm-client installs a lightweight local HTTP server on the user's machine. This server exposes APIs intended for interaction between the client and Chunghwa Telecom's target website. The server accepts requests originating from any browser context on the host, including third-party origins. Because the endpoints do not validate the request origin or enforce anti-CSRF tokens, any webpage loaded by the user can issue authenticated calls to these APIs. One endpoint accepts a file path parameter and returns the file contents to the caller. The path handling logic does not normalize traversal sequences, allowing attackers to reference files outside the intended directory.
Root Cause
The root cause is twofold. First, the local API server omits CSRF protections such as origin checks, referer validation, or synchronizer tokens. Second, a file-serving endpoint fails to sanitize user-supplied path components, permitting relative path traversal sequences such as ..\ or ../ to escape the intended base directory. Together these defects transform a local convenience API into a remotely reachable file disclosure primitive.
Attack Vector
An attacker hosts a malicious webpage and directs a topm-client user to visit it through phishing. The page issues cross-origin requests to the local API server bound to 127.0.0.1 on the victim's machine. The request supplies a traversal payload targeting sensitive files such as configuration files, credential stores, or user documents. The API returns the file contents to the attacker-controlled JavaScript, which exfiltrates the data. No authentication is required, and the victim only needs to browse to the malicious page.
Refer to the TWCCERT Security Advisory 8303 and TWCCERT Security Advisory 8297 for additional technical detail.
Detection Methods for CVE-2024-12645
Indicators of Compromise
- Outbound HTTP requests from browsers to localhost or 127.0.0.1 on the port used by topm-client originating from non-Chunghwa Telecom domains.
- Local API requests containing path traversal patterns such as ..%2F, ..\, or ../ in query parameters.
- Unexpected file read activity by the topm-client process targeting user profile directories or system configuration paths.
Detection Strategies
- Inspect web proxy or browser telemetry for cross-origin requests directed at loopback services on endpoints where topm-client is installed.
- Correlate process telemetry from the topm-client binary with reads of sensitive files outside its installation directory.
- Alert on HTTP requests to the local API whose Origin or Referer headers do not match approved Chunghwa Telecom domains.
Monitoring Recommendations
- Enable endpoint file access auditing for the user profile, credential storage, and application data directories.
- Log all HTTP transactions handled by the topm-client local server, including headers and full request paths.
- Retain browser network logs to support retrospective investigation of phishing-driven exploitation attempts.
How to Mitigate CVE-2024-12645
Immediate Actions Required
- Update topm-client to the version released by Chunghwa Telecom that addresses the path traversal and CSRF weaknesses. Consult the TWCCERT advisory for fixed version details.
- Remove or disable the topm-client on endpoints where it is not required for business operations.
- Deliver targeted phishing awareness communications to users of the client, focusing on links that redirect to unfamiliar domains.
Patch Information
Chunghwa Telecom addressed the vulnerability in an updated release of topm-client. Refer to the TWCCERT advisories referenced above for the fixed version identifier and download location. Apply the update across all affected endpoints and confirm the local API server enforces origin validation and path canonicalization after upgrade.
Workarounds
- Block outbound access from topm-client users to untrusted domains using web filtering to reduce phishing exposure.
- Configure host-based firewall rules to restrict which processes can bind to or connect to the loopback port used by the client.
- Uninstall the application on systems that do not require access to the Chunghwa Telecom target website.
# Example: block browser access to the local topm-client port via Windows Firewall
# Replace <PORT> with the local API port used by topm-client
netsh advfirewall firewall add rule name="Block topm-client Loopback" ^
dir=in action=block protocol=TCP localport=<PORT> remoteip=127.0.0.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.