CVE-2024-45241 Overview
CVE-2024-45241 is a path traversal vulnerability in GeneralDocs.aspx within CentralSquare CryWolf (False Alarm Management) through 2024-08-09. Unauthenticated attackers can abuse the rpt parameter to read files outside of the working web directory. Successful exploitation results in disclosure of sensitive information stored on the host. CryWolf is deployed by public safety agencies to manage false alarm billing and citizen-facing portals, making exposed instances reachable from the public internet. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Unauthenticated remote attackers can read arbitrary files from the web server, potentially exposing configuration files, credentials, and sensitive resident data managed by the application.
Affected Products
- CentralSquare CryWolf (False Alarm Management) — all versions through 2024-08-09
- GeneralDocs.aspx endpoint exposed by the CryWolf web application
- Public-facing CryWolf deployments used by municipal public safety agencies
Discovery Timeline
- 2024-08-26 - CVE-2024-45241 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-45241
Vulnerability Analysis
The vulnerability resides in the GeneralDocs.aspx handler shipped with CentralSquare CryWolf. The handler accepts an rpt query parameter that identifies the document to render. The application concatenates the supplied value into a file system path without validating or canonicalizing the input. As a result, traversal sequences such as ..\ or ../ escape the intended document directory and resolve to arbitrary locations on the underlying Windows host.
Because the endpoint does not require authentication, exploitation requires only network access to the CryWolf web server. Attackers can retrieve web.config, application source files, IIS logs, or any file readable by the application pool identity. Disclosed credentials and database connection strings often enable follow-on access to backend systems holding citizen records.
The weakness maps to CWE-22. Public technical analysis and a proof-of-concept request are available in the Daly Blog write-up and the GitHub PoC repository. EPSS data places exploitation likelihood in the 95th percentile, indicating active interest from opportunistic scanners.
Root Cause
The rpt parameter is passed to a file-read routine without normalization, allow-listing, or restriction to a base directory. Standard defenses such as Path.GetFullPath containment checks or mapping requests to whitelisted document identifiers are absent.
Attack Vector
Exploitation occurs over HTTP or HTTPS against a network-reachable CryWolf instance. An attacker issues a GET request to GeneralDocs.aspx with the rpt parameter populated with directory traversal sequences pointing at a target file. No credentials, user interaction, or prior access is required. See the published proof-of-concept for the exact request format.
Detection Methods for CVE-2024-45241
Indicators of Compromise
- IIS or reverse proxy access logs containing requests to GeneralDocs.aspx where the rpt parameter includes ..\, ../, %2e%2e%2f, or %2e%2e%5c sequences
- Requests targeting sensitive paths such as web.config, appsettings, or Windows system files via the rpt parameter
- Unusual volumes of GeneralDocs.aspx requests from a single source address, indicative of automated scanning
Detection Strategies
- Inspect web server logs for any rpt parameter value that does not match the expected document naming convention used by CryWolf
- Deploy WAF or IDS signatures that flag encoded and unencoded directory traversal patterns against the GeneralDocs.aspx URI
- Correlate file-read operations performed by the IIS application pool identity against files outside the CryWolf working directory
Monitoring Recommendations
- Forward IIS logs to a centralized analytics platform and alert on traversal patterns targeting CryWolf endpoints
- Monitor file system access on the CryWolf server for reads of web.config, credential stores, and log files by the w3wp.exe process
- Track outbound data volume from the web tier to detect bulk file exfiltration following successful traversal attempts
How to Mitigate CVE-2024-45241
Immediate Actions Required
- Restrict network access to CryWolf web servers to trusted networks until a vendor patch is verified and applied
- Deploy a WAF rule blocking GeneralDocs.aspx requests containing .., %2e%2e, or backslash sequences in the rpt parameter
- Audit IIS logs for prior exploitation attempts and rotate any credentials, certificates, or secrets stored on the affected host
Patch Information
No public vendor advisory or patch URL is referenced in the CVE record at the time of writing. Operators should contact CentralSquare directly for remediation guidance and confirm any fixed release before redeploying the application. Refer to the CentralSquare CryWolf product page for vendor contact information.
Workarounds
- Place the CryWolf application behind an authenticated reverse proxy or VPN to remove unauthenticated internet exposure
- Configure URL filtering at the load balancer to drop any request to GeneralDocs.aspx whose rpt parameter does not match a strict allow-list of document identifiers
- Run the IIS application pool under a least-privilege account that cannot read configuration files, secrets, or content outside the CryWolf document root
# Example WAF rule pattern (ModSecurity) to block traversal in the rpt parameter
SecRule ARGS:rpt "@rx (\.\.[\\/])|(%2e%2e(%2f|%5c))" \
"id:1004524101,phase:2,deny,log,status:403,\
msg:'CVE-2024-45241 CryWolf GeneralDocs.aspx path traversal attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
