CVE-2024-41163: Anka Build Cloud Path Traversal Flaw

CVE-2024-41163 Overview

CVE-2024-41163 is a directory traversal vulnerability in the archive functionality of Veertu Anka Build Cloud version 1.42.0. An unauthenticated attacker can send a specially crafted HTTP request to read sensitive files on the host system. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

The vulnerability requires no authentication, no user interaction, and is exploitable over the network. Veertu Anka Build Cloud is a macOS and iOS CI/CD orchestration platform used to manage build agents at scale, making any information disclosure on these systems impactful for software supply chain integrity.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from Anka Build Cloud servers, potentially exposing credentials, configuration data, and build artifacts.

Affected Products

Veertu Anka Build Cloud 1.42.0
Archive functionality HTTP endpoint
macOS-based CI/CD build orchestration deployments

Discovery Timeline

2024-10-03 - CVE-2024-41163 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41163

Vulnerability Analysis

The vulnerability resides in the archive functionality exposed by the Anka Build Cloud HTTP service. The service fails to properly canonicalize and validate user-supplied path components within archive-related HTTP requests. As a result, path traversal sequences such as ../ are interpreted relative to the working directory rather than being constrained to an intended archive root.

The attacker submits an unauthenticated HTTP request containing traversal sequences in a path parameter. The server resolves the path outside the intended directory and returns the contents of arbitrary files readable by the service account. According to the Talos Intelligence Vulnerability Report (TALOS-2024-2059), exploitation results in disclosure of sensitive information without any authentication step.

The vulnerability scores 7.5 with confidentiality impact rated High while integrity and availability are unaffected. The EPSS probability of 47.1% (98.68 percentile) indicates a high relative likelihood of exploitation activity compared to other published CVEs.

Root Cause

The root cause is insufficient input validation in path handling within the archive endpoint. The application concatenates attacker-controlled input into a filesystem path without normalizing traversal sequences or enforcing a base directory constraint. This permits the request handler to escape the archive directory and access files anywhere the service process has read permissions.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP GET or POST request to the archive endpoint of an exposed Anka Build Cloud controller. The request contains directory traversal payloads in a path or filename parameter. The server processes the request, traverses outside the archive directory, and returns the targeted file contents in the HTTP response. No credentials, tokens, or user interaction are required. Refer to the Talos vulnerability report for technical specifics.

Detection Methods for CVE-2024-41163

Indicators of Compromise

HTTP requests to Anka Build Cloud archive endpoints containing ../, ..%2f, or ..%5c sequences
Unauthenticated requests returning files outside the intended archive directory
Access log entries referencing system paths such as /etc/passwd, configuration files, or SSH keys
Anomalous response sizes from archive endpoints not correlated with legitimate build artifacts

Detection Strategies

Inspect Anka Build Cloud HTTP access logs for traversal patterns in URI paths and query parameters
Deploy WAF or reverse proxy rules to flag and block encoded and double-encoded traversal sequences
Correlate archive endpoint requests with source IP reputation and authentication state
Alert on any unauthenticated request to archive endpoints originating from outside trusted CI/CD networks

Monitoring Recommendations

Forward Anka Build Cloud web server logs to a centralized SIEM for retention and correlation
Baseline normal archive request patterns and alert on deviations in volume or path structure
Monitor outbound data volume from Anka controllers to detect bulk file exfiltration
Track filesystem access events on the controller host for reads outside the archive base directory

How to Mitigate CVE-2024-41163

Immediate Actions Required

Restrict network access to Anka Build Cloud controllers using firewall rules, allowing only trusted CI/CD networks
Place the Anka Build Cloud HTTP service behind an authenticating reverse proxy until a vendor patch is applied
Audit the controller host for sensitive files that could be exposed through traversal, including credentials and SSH keys
Review historical access logs for traversal sequences indicating prior exploitation attempts

Patch Information

At the time of NVD publication, no vendor advisory URL is listed for CVE-2024-41163. Operators should consult Veertu directly for an updated build of Anka Build Cloud that addresses the archive endpoint path validation issue. Reference the Talos Intelligence Vulnerability Report (TALOS-2024-2059) for coordinated disclosure details.

Workarounds

Block external access to the archive endpoint at the network edge using ACLs or WAF rules
Reject HTTP requests containing ../, ..%2f, ..%5c, and double-encoded traversal sequences
Run the Anka Build Cloud service under a least-privilege account that cannot read sensitive host files
Segment build infrastructure from production networks to limit blast radius of information disclosure

bash

# Example NGINX reverse proxy rule to block traversal patterns
location /archive/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c|%2e%2e)") {
        return 403;
    }
    proxy_pass http://anka_backend;
}