CVE-2024-12830: Arista NG Firewall RCE Vulnerability

CVE-2024-12830 Overview

CVE-2024-12830 is a directory traversal vulnerability in Arista NG Firewall that enables unauthenticated remote code execution. The flaw resides in the custom_handler method, which fails to properly validate a user-supplied path before using it in file operations. Attackers can exploit this weakness over the network without authentication or user interaction. Successful exploitation grants code execution in the context of the www-data user. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-24019 and disclosed publicly as ZDI-24-1718.

Critical Impact
Unauthenticated attackers can achieve remote code execution as www-data on affected Arista NG Firewall installations by exploiting improper path validation in the custom_handler method.

Affected Products

Arista NG Firewall 17.1.1
Arista NG Firewall (all builds exposing the vulnerable custom_handler method)
Deployments accepting network requests to the affected web management component

Discovery Timeline

2024-12-20 - CVE-2024-12830 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12830

Vulnerability Analysis

The vulnerability is a path traversal flaw classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). The custom_handler method accepts a path parameter from remote clients and uses it directly in file operations without normalization or containment checks. Attackers can supply traversal sequences such as ../ to escape the intended directory and reference or write arbitrary files. Because the flaw leads to code execution rather than pure file disclosure, an attacker can plant executable content in a location processed by the web server or otherwise coerce the application into running attacker-controlled logic. The resulting execution runs as the www-data account used by the firewall's web services.

Root Cause

The root cause is missing validation of the user-supplied path before it is used in file operations inside custom_handler. The application trusts client input and does not canonicalize the path or restrict it to a safe base directory. This absence of input sanitization is the defining characteristic of directory traversal weaknesses under [CWE-22].

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the vulnerable endpoint on the firewall management interface, supplying a traversal payload that reaches custom_handler. The endpoint processes the path, performs the file operation outside the intended directory, and enables code execution as www-data. Refer to the Zero Day Initiative Advisory ZDI-24-1718 for additional technical context.

// No verified public proof-of-concept code is available.
// See ZDI-24-1718 for vendor-coordinated technical details.

Detection Methods for CVE-2024-12830

Indicators of Compromise

HTTP requests to the NG Firewall management interface containing path traversal sequences such as ../, ..%2f, or encoded variants targeting the custom_handler endpoint.
Unexpected file writes or new files owned by www-data outside standard web application directories.
New or modified scripts, PHP/JSP files, or shell payloads placed in web-accessible locations on the firewall appliance.
Outbound network connections from the www-data process to attacker-controlled infrastructure.

Detection Strategies

Inspect web server access logs for requests containing traversal patterns targeting handler endpoints on the firewall management service.
Monitor process creation events where the parent is the firewall web service and the child spawns shells, interpreters, or reconnaissance utilities.
Alert on file integrity changes within directories that the custom_handler path parameter should never reach.

Monitoring Recommendations

Forward NG Firewall access, error, and audit logs to a central SIEM for correlation against known traversal signatures.
Enable behavioral monitoring on the appliance host to flag unexpected www-data command execution.
Restrict and log all administrative access to the firewall management interface, treating any anomalous handler request as high priority.

How to Mitigate CVE-2024-12830

Immediate Actions Required

Restrict network access to the Arista NG Firewall management interface so that only trusted administrative networks can reach it.
Apply the vendor-provided update for Arista NG Firewall as soon as it is available and validated in a test environment.
Audit the appliance for signs of prior exploitation, focusing on files owned by www-data and unexpected outbound connections.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD record. Administrators should consult the Zero Day Initiative Advisory ZDI-24-1718 and Arista's official support channels for patch availability and fixed version information.

Workarounds

Place the NG Firewall management interface behind a VPN or jump host to eliminate untrusted network exposure.
Enforce strict network ACLs limiting inbound access to the web management service to known administrator source addresses.
Where feasible, disable or block requests to the vulnerable handler path via an upstream reverse proxy or web application firewall rule that rejects traversal sequences.

bash

# Example: restrict management interface access with host-based firewall rules
# Replace the source range with your trusted administrator network
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP