CVE-2024-25153: Fortra FileCatalyst Path Traversal Flaw

CVE-2024-25153 Overview

A critical directory traversal vulnerability exists within the ftpservlet component of the Fortra FileCatalyst Workflow Web Portal. This flaw allows unauthenticated attackers to upload files outside of the intended uploadtemp directory using specially crafted POST requests. When successfully exploited, attackers can upload malicious JSP files to the web portal's DocumentRoot, enabling arbitrary code execution including the deployment of web shells.

Critical Impact

Unauthenticated remote attackers can achieve full system compromise through arbitrary file upload and subsequent code execution via malicious JSP web shells.

Affected Products

• Fortra FileCatalyst Workflow (versions prior to 5.1.6 Build 114)
• Fortra FileCatalyst Workflow 5.1.6 Build 112

Discovery Timeline

• 2024-03-13 - CVE-2024-25153 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2024-25153

Vulnerability Analysis

This directory traversal vulnerability (CWE-472, CWE-668) affects the ftpservlet component responsible for handling file uploads in the FileCatalyst Workflow Web Portal. The servlet fails to properly validate and sanitize file path parameters in incoming POST requests, allowing attackers to use path traversal sequences to write files to arbitrary locations on the server's filesystem.

The vulnerability is particularly severe because the affected component is accessible without authentication and the application runs with sufficient privileges to write to the web application's DocumentRoot. This combination enables attackers to bypass upload directory restrictions and place executable content directly in locations where it will be processed by the application server.

Root Cause

The root cause stems from improper input validation in the ftpservlet component. The servlet processes user-supplied file path information without adequately sanitizing directory traversal sequences such as ../. This allows an attacker to escape the intended uploadtemp directory and navigate to arbitrary filesystem locations, including the web portal's DocumentRoot where JSP files are executed.

The vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and CWE-668 (Exposure of Resource to Wrong Sphere), reflecting both the input validation failure and the resulting unauthorized access to protected filesystem locations.

Attack Vector

The attack is executed remotely over the network without requiring authentication or user interaction. An attacker sends a specially crafted HTTP POST request to the vulnerable ftpservlet endpoint, including path traversal sequences in the filename parameter. By navigating up the directory structure and into the DocumentRoot, the attacker can upload a malicious JSP file.

Once the JSP file is in place, the attacker accesses it via a web request, causing the application server to execute the embedded Java code. This typically involves deploying a web shell that provides persistent command execution capabilities on the compromised server.

The exploitation flow typically involves:

1. Crafting a POST request with directory traversal sequences targeting the DocumentRoot
2. Uploading a JSP web shell payload through the manipulated path
3. Accessing the uploaded JSP file via HTTP to trigger code execution
4. Establishing persistent access through the deployed web shell

A proof-of-concept exploit is available in the Nettitude GitHub repository demonstrating the exploitation technique.

Detection Methods for CVE-2024-25153

Indicators of Compromise

• Unexpected JSP files appearing in the FileCatalyst Workflow DocumentRoot or web application directories
• HTTP POST requests to /ftpservlet containing path traversal sequences (../ patterns) in request parameters
• Newly created or modified JSP files with recent timestamps that don't match deployment schedules
• Web shell activity patterns including suspicious command execution or reverse shell connections from the web server

Detection Strategies

• Monitor HTTP access logs for POST requests to the ftpservlet endpoint containing encoded or plaintext directory traversal patterns
• Implement file integrity monitoring (FIM) on the FileCatalyst Workflow DocumentRoot to detect unauthorized file additions
• Deploy web application firewall (WAF) rules to block requests containing path traversal sequences targeting upload endpoints
• Review server filesystem for JSP files created outside of normal deployment processes

Monitoring Recommendations

• Enable detailed logging for the FileCatalyst Workflow application and review logs for anomalous upload activity
• Configure alerts for new JSP file creation events in the web application directories
• Monitor outbound network connections from the web server for potential command and control traffic
• Implement network segmentation to limit lateral movement potential if the server is compromised

How to Mitigate CVE-2024-25153

Immediate Actions Required

• Update Fortra FileCatalyst Workflow to version 5.1.6 Build 114 or later immediately
• If immediate patching is not possible, consider temporarily disabling the ftpservlet endpoint or restricting network access to the FileCatalyst Workflow Web Portal
• Review server logs and filesystem for indicators of compromise to determine if exploitation has already occurred
• Implement network-level access controls to limit exposure of the FileCatalyst Workflow Web Portal to trusted networks only

Patch Information

Fortra has released a security patch addressing this vulnerability in FileCatalyst Workflow version 5.1.6 Build 114. Organizations should upgrade to this version or later as soon as possible. The fix implements proper input validation and sanitization for file upload paths in the ftpservlet component.

For detailed patch information, refer to the Fortra Security Advisory FI-2024-002 and the FileCatalyst Release Notes.

Workarounds

• Restrict network access to the FileCatalyst Workflow Web Portal using firewall rules to allow only trusted IP addresses
• Deploy a web application firewall (WAF) with rules to detect and block path traversal attempts in HTTP requests
• If the FTP upload functionality via the web portal is not required, consider disabling the ftpservlet component entirely
• Implement strict file type validation at the network perimeter to block JSP file uploads

# Example: Restrict access to FileCatalyst Workflow using iptables
# Allow access only from trusted management network
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP