CVE-2024-42449: VSPC Path Traversal Vulnerability

CVE-2024-42449 Overview

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.

Critical Impact
High impact on integrity and availability

Affected Products

Not Available
Not Available
Not Available

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to Not Available
Not Available - CVE CVE-2024-42449 assigned
Not Available - Not Available releases security patch
2024-12-04 - CVE CVE-2024-42449 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-42449

Vulnerability Analysis

This vulnerability is categorized under CWE-732, indicating improper file permissions. The condition arises when the VSPC management agent, once authorized, can execute operations to delete files without appropriate restrictions, leading to potential file destruction and system integrity issues.

Root Cause

The root cause is improper handling and validation of file permissions by the VSPC management agent, allowing unauthorized file deletion.

Attack Vector

Network-based attack, exploiting weak authorization controls to manipulate file deletion commands remotely.

bash

# Example exploitation code (sanitized)
import requests

url = "http://vspc-server/vulnerable-endpoint"
payload = {"file": "/path/to/important/file"}

response = requests.delete(url, json=payload)
print(response.status_code)

Detection Methods for CVE-2024-42449

Indicators of Compromise

Unauthorized file deletions detected in logs
Suspicious requests from known management agents
Unusual network traffic patterns

Detection Strategies

Leverage SentinelOne's EDR capabilities to monitor process activities on the VSPC servers. Look for unexpected file operations and correlate with unauthorized sessions.

Monitoring Recommendations

Continuously log and audit file access and deletion activities. Implement anomaly detection mechanisms to flag unusual patterns.

How to Mitigate CVE-2024-42449

Immediate Actions Required

Review and restrict file permissions for VSPC agents
Monitor network traffic for suspicious activity
Reinforce access control mechanisms on the VSPC server

Patch Information

Regularly check for updates from Veeam and install patches that address this vulnerability. Refer to Veeam Advisory for more details.

Workarounds

Implement strict access control lists (ACLs) to restrict file operations by unauthorized agents. Consider isolating critical files in secure directories.