CVE-2024-43035: Fonoster Path Traversal Vulnerability

CVE-2024-43035 Overview

CVE-2024-43035 is a directory traversal vulnerability affecting Fonoster versions 0.5.5 before 0.6.1. The vulnerability allows attackers to read arbitrary files on the server via the /sounds/:file or /tts/:file VoiceServer endpoints by using ../ path traversal sequences. This Local File Inclusion (LFI) vulnerability occurs in the serveFiles function located in mods/voice/src/utils.ts.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to read sensitive system files, configuration data, and potentially credentials stored on the affected Fonoster server, leading to information disclosure and possible further system compromise.

Affected Products

• Fonoster versions 0.5.5 to versions before 0.6.1
• VoiceServer component (mods/voice/src/utils.ts)
• Systems exposing /sounds/:file and /tts/:file endpoints

Discovery Timeline

• 2026-03-05 - CVE CVE-2024-43035 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2024-43035

Vulnerability Analysis

This vulnerability stems from inadequate input validation in the serveFiles function within Fonoster's VoiceServer component. The function fails to properly sanitize user-supplied file path parameters, allowing attackers to escape the intended directory using relative path traversal sequences (../). When a request is made to the /sounds/:file or /tts/:file endpoints, the :file parameter is not sufficiently validated before being used in file system operations.

The vulnerable code exists in Fonoster version 0.5.5 within the serveFiles function. This function was removed entirely in version 0.6.1, eliminating the vulnerable code path. The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it particularly concerning for internet-facing deployments.

Root Cause

The root cause is classified under CWE-24 (Path Traversal: '../filedir'). The serveFiles function in mods/voice/src/utils.ts directly uses user-supplied input to construct file paths without proper validation or canonicalization. The function fails to:

1. Sanitize path traversal sequences (../) from the input
2. Validate that the resolved path remains within the intended base directory
3. Implement path canonicalization before file access

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the /sounds/:file or /tts/:file endpoints with path traversal sequences to escape the intended directory and access arbitrary files on the system. For example, requests containing sequences like ../../../etc/passwd could be used to read sensitive system files.

The vulnerability is accessible via standard HTTP requests, making exploitation straightforward for any attacker who can reach the VoiceServer endpoints. A proof-of-concept is available demonstrating this attack technique. For detailed technical analysis, see the ZeroPath Blog LFI Vulnerability writeup and the GitHub Voice Utils Code reference.

Detection Methods for CVE-2024-43035

Indicators of Compromise

• HTTP requests to /sounds/ or /tts/ endpoints containing ../ path traversal sequences
• Log entries showing requests for system files like /etc/passwd, /etc/shadow, or configuration files
• Unusual file access patterns in application or web server logs targeting files outside the sounds or TTS directories
• Requests with URL-encoded traversal sequences (%2e%2e%2f) in the file parameter

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in request URLs
• Monitor HTTP access logs for requests containing ../ or encoded variants targeting the VoiceServer endpoints
• Deploy intrusion detection system (IDS) signatures for Local File Inclusion attack patterns
• Configure file integrity monitoring on sensitive system files to detect unauthorized read attempts

Monitoring Recommendations

• Enable detailed access logging for all requests to /sounds/ and /tts/ endpoints
• Set up real-time alerting for requests containing path traversal sequences
• Monitor for anomalous patterns of file access outside normal application directories
• Review VoiceServer logs regularly for signs of exploitation attempts

How to Mitigate CVE-2024-43035

Immediate Actions Required

• Upgrade Fonoster to version 0.6.1 or later, which removes the vulnerable serveFiles function entirely
• If immediate upgrade is not possible, restrict network access to the /sounds/ and /tts/ endpoints
• Implement a web application firewall (WAF) to filter path traversal patterns
• Review access logs for evidence of past exploitation attempts

Patch Information

The vulnerability is resolved in Fonoster version 0.6.1, where the vulnerable serveFiles function was completely removed from the codebase. Organizations running Fonoster 0.5.5 should upgrade directly to version 0.6.1 or later to eliminate this vulnerability. The fix was implemented by removing the vulnerable code path rather than attempting to patch the input validation, ensuring a complete remediation.

Workarounds

• Restrict access to the VoiceServer endpoints (/sounds/:file and /tts/:file) at the network level using firewall rules
• Deploy a reverse proxy with path traversal filtering capabilities in front of the Fonoster server
• Implement application-level input validation to reject requests containing .. sequences
• Limit file system permissions for the Fonoster process to minimize the impact of file disclosure

# Configuration example
# Example nginx configuration to block path traversal attempts
location ~ ^/(sounds|tts)/ {
    if ($uri ~ "\.\.") {
        return 403;
    }
    # Additional hardening: limit to internal networks only
    # allow 10.0.0.0/8;
    # deny all;
    proxy_pass http://fonoster_backend;
}