CVE-2024-12646: topm-client Path Traversal Vulnerability

CVE-2024-12646 Overview

CVE-2024-12646 affects the topm-client application from Chunghwa Telecom. The client runs a local web server that exposes APIs for communication with a target website. The APIs lack Cross-Site Request Forgery (CSRF) protection, and one endpoint contains an Absolute Path Traversal flaw [CWE-36]. An unauthenticated remote attacker can chain these weaknesses through phishing to delete arbitrary files on a victim's system. Exploitation requires user interaction, typically by luring the target to a malicious webpage. Successful attacks compromise system integrity and availability without needing any credentials on the host.

Critical Impact
Remote unauthenticated attackers can delete arbitrary files on any Windows host running the topm-client, potentially rendering the operating system or critical applications inoperable.

Affected Products

Chunghwa Telecom topm-client
Local web server API component of topm-client
Endpoints reachable via the loopback interface exposed by the client

Discovery Timeline

2024-12-16 - CVE-2024-12646 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12646

Vulnerability Analysis

The topm-client installs a lightweight local HTTP server on the user's machine to broker requests between the desktop and a remote web application. This server exposes several APIs but does not validate the origin of incoming requests. Because the endpoints accept cross-origin requests without CSRF tokens or origin checks, any webpage a user visits can issue authenticated-looking calls to the loopback service. One of these endpoints accepts a file path parameter used to remove files. The parameter is passed to a delete operation without sanitization or restriction to a safe directory, permitting absolute path traversal. An attacker can therefore target files outside the application scope, including operating system components or user data.

Root Cause

Two defects combine to enable exploitation. First, the local API lacks CSRF protection, meaning arbitrary websites can trigger requests to the loopback server. Second, the file deletion endpoint performs no path canonicalization or allowlist enforcement, allowing absolute paths such as C:\Windows\System32\... to reach the file removal routine. This aligns with Common Weakness Enumeration entry [CWE-36] Absolute Path Traversal.

Attack Vector

Exploitation follows a phishing workflow. The attacker crafts a webpage containing JavaScript or an HTML form that issues a request to the topm-client loopback API, supplying an absolute file path as the target for deletion. When a victim with topm-client installed visits the page, the browser sends the request to the local service, which processes the file deletion without verifying the request origin or the path.

The vulnerability manifests in the file deletion API handler of the local web server. No verified proof-of-concept code is publicly available. Refer to the TWCERT Security Advisory for vendor-published technical details.

Detection Methods for CVE-2024-12646

Indicators of Compromise

Unexpected HTTP requests originating from browsers to 127.0.0.1 or localhost on ports bound by topm-client
Missing or deleted system files, application binaries, or user documents on hosts with topm-client installed
Browser history entries referencing untrusted domains immediately preceding file deletion events

Detection Strategies

Monitor process file-deletion telemetry originating from the topm-client process for paths outside its installation directory
Inspect outbound HTTP traffic from browsers to loopback listeners for POST or GET requests containing file path parameters
Correlate file removal events with recent web navigation activity to identify phishing-triggered deletions

Monitoring Recommendations

Enable file integrity monitoring on system directories and critical application paths on endpoints running topm-client
Log local HTTP requests reaching the topm-client service and alert on cross-origin Referer or Origin headers
Track EDR telemetry for file delete operations executed by the topm-client process with unusual target paths

How to Mitigate CVE-2024-12646

Immediate Actions Required

Update topm-client to the fixed version distributed by Chunghwa Telecom as referenced in the TWCERT Security Advisory
Uninstall topm-client on hosts where it is not actively required until patching is complete
Instruct users to avoid clicking untrusted links while topm-client is running on their workstation

Patch Information

Chunghwa Telecom has issued a fixed release of topm-client. Consult the TWCERT Incident Report and the vendor's distribution channel for the specific patched build and installation instructions.

Workarounds

Restrict outbound browser access to the loopback interface using host-based firewall rules where feasible
Terminate the topm-client local web server process when the application is not actively in use
Deploy browser policies that block cross-origin requests to loopback addresses on managed endpoints

bash

# Configuration example
# Windows firewall rule to block browser processes from reaching the topm-client loopback port
netsh advfirewall firewall add rule name="Block topm-client loopback" ^
  dir=out ^
  program="%ProgramFiles%\Mozilla Firefox\firefox.exe" ^
  remoteip=127.0.0.1 ^
  action=block