CVE-2024-42449: VSPC Path Traversal Vulnerability

CVE-2024-42449 Overview

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.

Critical Impact

High impact on integrity and availability

Affected Products

• Not Available
• Not Available
• Not Available

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Not Available
• Not Available - CVE CVE-2024-42449 assigned
• Not Available - Not Available releases security patch
• 2024-12-04 - CVE CVE-2024-42449 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-42449

Vulnerability Analysis

This vulnerability is categorized under CWE-732, indicating improper file permissions. The condition arises when the VSPC management agent, once authorized, can execute operations to delete files without appropriate restrictions, leading to potential file destruction and system integrity issues.

Root Cause

The root cause is improper handling and validation of file permissions by the VSPC management agent, allowing unauthorized file deletion.

Attack Vector

Network-based attack, exploiting weak authorization controls to manipulate file deletion commands remotely.

# Example exploitation code (sanitized)
import requests

url = "http://vspc-server/vulnerable-endpoint"
payload = {"file": "/path/to/important/file"}

response = requests.delete(url, json=payload)
print(response.status_code)

Detection Methods for CVE-2024-42449

Indicators of Compromise

• Unauthorized file deletions detected in logs
• Suspicious requests from known management agents
• Unusual network traffic patterns

Detection Strategies

Leverage SentinelOne's EDR capabilities to monitor process activities on the VSPC servers. Look for unexpected file operations and correlate with unauthorized sessions.

Monitoring Recommendations

Continuously log and audit file access and deletion activities. Implement anomaly detection mechanisms to flag unusual patterns.

How to Mitigate CVE-2024-42449

Immediate Actions Required

• Review and restrict file permissions for VSPC agents
• Monitor network traffic for suspicious activity
• Reinforce access control mechanisms on the VSPC server

Patch Information

Regularly check for updates from Veeam and install patches that address this vulnerability. Refer to Veeam Advisory for more details.

Workarounds

Implement strict access control lists (ACLs) to restrict file operations by unauthorized agents. Consider isolating critical files in secure directories.

# Configuration example
chmod 700 /secure/directory
chown root:root /secure/directory