CVE-2024-41628: Cluster Control Path Traversal Flaw

CVE-2024-41628 Overview

CVE-2024-41628 is a directory traversal vulnerability affecting Severalnines ClusterControl, a database cluster management platform. The flaw resides in the CMON API and allows a remote, unauthenticated attacker to include and display arbitrary file contents through a crafted HTTP request. Successful exploitation exposes sensitive files on the host, including configuration data and credential material readable by the CMON service account.

The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. A public proof-of-concept is available on GitHub, and the EPSS score of 91.47% (99.68 percentile) indicates a high likelihood of exploitation activity.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from ClusterControl servers via the CMON API, exposing credentials and configuration data that can enable lateral movement into managed database clusters.

Affected Products

Severalnines ClusterControl 1.9.8 before 1.9.8-9778
Severalnines ClusterControl 2.0.0 before 2.0.0-9779
Severalnines ClusterControl 2.1.0 before 2.1.0-9780

Discovery Timeline

2024-07-24 - Severalnines releases maintenance update addressing the issue (Changelog v1.9.8)
2024-07-26 - CVE-2024-41628 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-41628

Vulnerability Analysis

ClusterControl exposes the CMON API over HTTP/HTTPS to manage database cluster operations. The API endpoint responsible for file handling fails to sanitize path input supplied by the client. An attacker submits a request containing directory traversal sequences such as ../ to escape the intended base directory. The server then resolves the path against the local filesystem and returns the file contents in the HTTP response.

Because the CMON controller typically runs with elevated privileges to manage cluster configurations, the attacker can read files owned by root or the cmon service user. Targets of interest include /etc/cmon.cnf, /etc/passwd, /etc/shadow, SSH private keys under /root/.ssh/, and database credential files cached by ClusterControl for managed nodes.

Root Cause

The root cause is missing input validation on a path parameter in the CMON API request handler. The endpoint accepts a filename argument intended to reference logs or configuration assets within a restricted directory. No canonicalization or allowlist check is applied before passing the value to filesystem read operations, permitting traversal outside the intended directory tree.

Attack Vector

Exploitation requires only network access to the CMON API listener, which by default binds to TCP/9501 on the ClusterControl server. No authentication or user interaction is required. An attacker issues a single HTTP request containing a traversal payload in the vulnerable parameter and parses the file contents from the JSON response. The public proof-of-concept at Redshift-CyberSecurity/CVE-2024-41628 demonstrates the request structure and parameter placement.

Detection Methods for CVE-2024-41628

Indicators of Compromise

HTTP requests to the CMON API containing ../, ..%2f, or URL-encoded traversal sequences in path parameters.
Unexpected outbound responses from the CMON listener containing contents of /etc/passwd, /etc/shadow, or cmon.cnf.
Access log entries for CMON API endpoints from external or untrusted IP addresses without prior authentication context.
Sudden spikes in 200 OK responses to anomalous file-reference parameters in CMON API traffic.

Detection Strategies

Inspect web server and CMON access logs for path traversal patterns and decode URL-encoded sequences before pattern matching.
Deploy network IDS signatures matching GET or POST requests to CMON API paths containing traversal tokens.
Correlate API request bursts against the public PoC payload structure documented in the referenced GitHub repository.

Monitoring Recommendations

Forward CMON API and reverse proxy logs to a centralized analytics platform for retention and rule-based detection.
Alert on any successful read of sensitive filesystem locations through the CMON service process.
Monitor for credential reuse from ClusterControl-managed nodes following any suspicious CMON API activity.

How to Mitigate CVE-2024-41628

Immediate Actions Required

Upgrade ClusterControl to 1.9.8-9778, 2.0.0-9779, 2.1.0-9780, or later without delay.
Restrict network access to the CMON API (TCP/9501) to trusted management subnets using host or network firewalls.
Rotate all credentials, SSH keys, and API tokens stored on the ClusterControl server, assuming potential exposure.
Review CMON access logs since installation for evidence of traversal exploitation against the affected versions.

Patch Information

Severalnines addressed the vulnerability in the July 24, 2024 maintenance release. Fixed builds are documented in the ClusterControl v1.9.8 changelog and the ClusterControl v2.1.0 changelog. Apply the patch through the standard s9s-update or package manager workflow appropriate for your distribution.

Workarounds

Place the CMON API behind an authenticating reverse proxy that filters traversal sequences before requests reach the backend.
Apply firewall rules limiting inbound TCP/9501 access to administrator workstations and automation systems only.
Run the CMON service under the least privileges necessary to reduce the impact of arbitrary file reads.

bash

# Example iptables restriction limiting CMON API access to a management subnet
iptables -A INPUT -p tcp --dport 9501 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9501 -j DROP