CVE-2024-27292: Docassemble Information Disclosure Flaw

CVE-2024-27292 Overview

Docassemble, an expert system for guided interviews and document assembly, contains a path traversal vulnerability that allows attackers to gain unauthorized access to sensitive information on the system through URL manipulation. This vulnerability stems from improper handling of user-supplied input in URL parameters, enabling attackers to bypass access controls and retrieve files or data they should not have access to.

Critical Impact

Attackers can exploit this vulnerability remotely without authentication to access sensitive system information through URL manipulation, potentially exposing confidential interview data, configuration files, and other protected resources.

Affected Products

• Jhpyle Docassemble versions 1.4.53 through 1.4.96
• All installations running affected versions exposed to network access
• Self-hosted and cloud deployments using vulnerable versions

Discovery Timeline

• 2024-03-21 - CVE-2024-27292 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2024-27292

Vulnerability Analysis

This vulnerability is classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference), which occurs when the application uses external input to construct a reference to a resource, but the input is not properly validated. In Docassemble's case, the application fails to adequately sanitize URL parameters before using them to access internal resources.

The vulnerability allows unauthenticated remote attackers to manipulate URL paths to access information outside the intended scope. Because the vulnerability requires no privileges and no user interaction, it presents a significant risk to confidentiality. Organizations using Docassemble for legal document assembly, intake forms, or other sensitive interview processes may have confidential client data exposed.

Root Cause

The root cause of CVE-2024-27292 lies in insufficient input validation and improper name or reference resolution within Docassemble's URL handling mechanisms. When processing user requests, the application fails to properly canonicalize and validate file paths or resource identifiers supplied through URL parameters. This allows attackers to craft malicious URLs that resolve to unintended resources on the server, bypassing the application's access control mechanisms.

Attack Vector

The attack is conducted remotely over the network and requires no authentication or user interaction. An attacker can exploit this vulnerability by crafting specially manipulated URLs that abuse the application's resource resolution logic. By inserting path traversal sequences or other manipulated references into URL parameters, the attacker can trick Docassemble into accessing and returning sensitive information that should be protected.

The vulnerability's network-based attack vector and lack of authentication requirements make it particularly dangerous for internet-facing Docassemble installations. Organizations using this software for public-facing interview or document assembly applications should prioritize remediation.

Detection Methods for CVE-2024-27292

Indicators of Compromise

• Unusual URL patterns in web server logs containing path traversal sequences such as ../ or encoded variants
• Access log entries showing requests for configuration files, system files, or paths outside normal application scope
• Increased 200 OK responses for requests to atypical resource paths
• Evidence of information extraction through abnormal response sizes for URL requests

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block path traversal patterns in URL parameters
• Implement intrusion detection system (IDS) signatures targeting URL manipulation attempts against Docassemble endpoints
• Monitor application logs for requests containing traversal sequences, null bytes, or URL-encoded path manipulations
• Enable verbose logging on Docassemble installations to capture detailed request information for forensic analysis

Monitoring Recommendations

• Configure real-time alerting for suspicious URL patterns targeting Docassemble services
• Establish baseline normal behavior for Docassemble URL request patterns and alert on deviations
• Monitor for reconnaissance activity such as sequential probing of different path patterns
• Review access logs regularly for evidence of successful information extraction attempts

How to Mitigate CVE-2024-27292

Immediate Actions Required

• Upgrade Docassemble to version 1.4.97 or later immediately to patch this vulnerability
• If immediate patching is not possible, consider temporarily restricting network access to the Docassemble installation
• Conduct a review of access logs to determine if the vulnerability has been exploited prior to patching
• Notify stakeholders if sensitive data may have been exposed through exploitation of this vulnerability

Patch Information

The vulnerability has been addressed in Docassemble version 1.4.97 of the master branch. The fix is available through the GitHub commit 97f77dc. Organizations should upgrade to the patched version as soon as possible. Additional technical details are available in the GitHub Security Advisory GHSA-jq57-3w7p-vwvv.

Workarounds

• Implement network-level access controls to restrict Docassemble access to trusted IP ranges only
• Deploy a web application firewall (WAF) in front of Docassemble with rules to block path traversal attempts
• Consider placing Docassemble behind a reverse proxy with strict URL filtering and validation
• Disable public network access to Docassemble installations until patching can be completed

# Example: Restrict network access using iptables
# Allow only trusted IP ranges to access Docassemble (port 443)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP