CVE-2024-43035: Fonoster Path Traversal Vulnerability

CVE-2024-43035 Overview

CVE-2024-43035 is a directory traversal vulnerability affecting Fonoster versions 0.5.5 before 0.6.1. The vulnerability allows attackers to read arbitrary files on the server via the /sounds/:file or /tts/:file VoiceServer endpoints by using ../ path traversal sequences. This Local File Inclusion (LFI) vulnerability occurs in the serveFiles function located in mods/voice/src/utils.ts.

Critical Impact
Unauthenticated attackers can exploit this path traversal vulnerability to read sensitive system files, configuration data, and potentially credentials stored on the affected Fonoster server, leading to information disclosure and possible further system compromise.

Affected Products

Fonoster versions 0.5.5 to versions before 0.6.1
VoiceServer component (mods/voice/src/utils.ts)
Systems exposing /sounds/:file and /tts/:file endpoints

Discovery Timeline

2026-03-05 - CVE CVE-2024-43035 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2024-43035

Vulnerability Analysis

This vulnerability stems from inadequate input validation in the serveFiles function within Fonoster's VoiceServer component. The function fails to properly sanitize user-supplied file path parameters, allowing attackers to escape the intended directory using relative path traversal sequences (../). When a request is made to the /sounds/:file or /tts/:file endpoints, the :file parameter is not sufficiently validated before being used in file system operations.

The vulnerable code exists in Fonoster version 0.5.5 within the serveFiles function. This function was removed entirely in version 0.6.1, eliminating the vulnerable code path. The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it particularly concerning for internet-facing deployments.

Root Cause

The root cause is classified under CWE-24 (Path Traversal: '../filedir'). The serveFiles function in mods/voice/src/utils.ts directly uses user-supplied input to construct file paths without proper validation or canonicalization. The function fails to:

Sanitize path traversal sequences (../) from the input
Validate that the resolved path remains within the intended base directory
Implement path canonicalization before file access

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the /sounds/:file or /tts/:file endpoints with path traversal sequences to escape the intended directory and access arbitrary files on the system. For example, requests containing sequences like ../../../etc/passwd could be used to read sensitive system files.

The vulnerability is accessible via standard HTTP requests, making exploitation straightforward for any attacker who can reach the VoiceServer endpoints. A proof-of-concept is available demonstrating this attack technique. For detailed technical analysis, see the ZeroPath Blog LFI Vulnerability writeup and the GitHub Voice Utils Code reference.

Detection Methods for CVE-2024-43035

Indicators of Compromise

HTTP requests to /sounds/ or /tts/ endpoints containing ../ path traversal sequences
Log entries showing requests for system files like /etc/passwd, /etc/shadow, or configuration files
Unusual file access patterns in application or web server logs targeting files outside the sounds or TTS directories
Requests with URL-encoded traversal sequences (%2e%2e%2f) in the file parameter

Detection Strategies

Implement web application firewall (WAF) rules to detect and block path traversal patterns in request URLs
Monitor HTTP access logs for requests containing ../ or encoded variants targeting the VoiceServer endpoints
Deploy intrusion detection system (IDS) signatures for Local File Inclusion attack patterns
Configure file integrity monitoring on sensitive system files to detect unauthorized read attempts

Monitoring Recommendations

Enable detailed access logging for all requests to /sounds/ and /tts/ endpoints
Set up real-time alerting for requests containing path traversal sequences
Monitor for anomalous patterns of file access outside normal application directories
Review VoiceServer logs regularly for signs of exploitation attempts

How to Mitigate CVE-2024-43035

Immediate Actions Required

Upgrade Fonoster to version 0.6.1 or later, which removes the vulnerable serveFiles function entirely
If immediate upgrade is not possible, restrict network access to the /sounds/ and /tts/ endpoints
Implement a web application firewall (WAF) to filter path traversal patterns
Review access logs for evidence of past exploitation attempts

Patch Information

The vulnerability is resolved in Fonoster version 0.6.1, where the vulnerable serveFiles function was completely removed from the codebase. Organizations running Fonoster 0.5.5 should upgrade directly to version 0.6.1 or later to eliminate this vulnerability. The fix was implemented by removing the vulnerable code path rather than attempting to patch the input validation, ensuring a complete remediation.

Workarounds

Restrict access to the VoiceServer endpoints (/sounds/:file and /tts/:file) at the network level using firewall rules
Deploy a reverse proxy with path traversal filtering capabilities in front of the Fonoster server
Implement application-level input validation to reject requests containing .. sequences
Limit file system permissions for the Fonoster process to minimize the impact of file disclosure

bash

# Configuration example
# Example nginx configuration to block path traversal attempts
location ~ ^/(sounds|tts)/ {
    if ($uri ~ "\.\.") {
        return 403;
    }
    # Additional hardening: limit to internal networks only
    # allow 10.0.0.0/8;
    # deny all;
    proxy_pass http://fonoster_backend;
}