CVE-2024-45256: BYOB Auth Bypass Vulnerability

CVE-2024-45256 Overview

An arbitrary file write vulnerability exists in the exfiltration endpoint of BYOB (Build Your Own Botnet) 2.0 that allows attackers to overwrite SQLite databases and bypass authentication via an unauthenticated HTTP request with a crafted parameter. This vulnerability occurs in the file_add function within api/files/routes.py.

Critical Impact

Unauthenticated attackers can remotely overwrite critical SQLite database files, enabling complete authentication bypass and potentially gaining full control over the BYOB command and control infrastructure.

Affected Products

• BYOB (Build Your Own Botnet) 2.0

Discovery Timeline

• 2024-08-26 - CVE-2024-45256 published to NVD
• 2024-08-26 - Last updated in NVD database

Technical Details for CVE-2024-45256

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), enabling arbitrary file write operations through the exfiltration endpoint. The flaw resides in the file_add function located in api/files/routes.py, which fails to properly validate and sanitize file path parameters submitted through HTTP requests.

The vulnerability allows unauthenticated remote attackers to craft malicious HTTP requests that can write arbitrary content to any location accessible by the BYOB server process. Most critically, attackers can target SQLite database files used for authentication, effectively allowing them to overwrite authentication credentials or user records and gain unauthorized access to the botnet command and control infrastructure.

Root Cause

The root cause stems from insufficient input validation in the file_add function within the exfiltration API endpoint. The function accepts user-supplied file path parameters without properly sanitizing path traversal sequences (such as ../) or validating that the target path remains within intended directories. This allows attackers to escape the designated upload directory and write files to arbitrary locations on the filesystem.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker crafts an HTTP request to the exfiltration endpoint with a maliciously constructed parameter containing path traversal sequences. By targeting the SQLite database files that store user credentials and session information, the attacker can overwrite these files with controlled content, effectively bypassing all authentication mechanisms.

The attack sequence involves:

1. Identifying a BYOB server instance accessible over the network
2. Crafting an HTTP request to the /api/files endpoint with path traversal characters
3. Specifying a target path pointing to SQLite authentication databases
4. Overwriting the database with attacker-controlled content to bypass authentication

Technical details and proof-of-concept code are available in the Chebuya Blog Post on RCE and the associated GitHub Exploits Repository.

Detection Methods for CVE-2024-45256

Indicators of Compromise

• HTTP requests to the exfiltration API endpoint containing path traversal sequences (../, ..%2f, or similar encoded variants)
• Unexpected modifications to SQLite database files, particularly those related to authentication
• Anomalous write operations to files outside the designated upload directories
• Unauthenticated access to BYOB administrative functions

Detection Strategies

• Monitor HTTP request logs for path traversal patterns in file upload parameters targeting /api/files endpoints
• Implement file integrity monitoring on critical SQLite database files and system configuration files
• Deploy web application firewalls (WAF) with rules to detect and block path traversal attempts
• Analyze network traffic for unauthenticated requests to sensitive API endpoints

Monitoring Recommendations

• Enable verbose logging for the BYOB web application to capture all file operation requests
• Set up alerts for any file write operations outside designated directories
• Monitor for sudden changes in database file sizes or modification timestamps
• Track authentication failures followed by unexpected successful authentications from the same source

How to Mitigate CVE-2024-45256

Immediate Actions Required

• Discontinue use of BYOB 2.0 until a patched version becomes available
• Restrict network access to the BYOB server to trusted IP addresses only
• Place the BYOB server behind a properly configured reverse proxy with path traversal filtering
• Implement network segmentation to isolate the BYOB infrastructure from critical systems

Patch Information

No official patch information is currently available from the vendor. Organizations using BYOB should monitor the MalwareDLLC BYOB GitHub Repository for security updates and patches.

Workarounds

• Implement strict input validation on the file_add function to sanitize file path parameters
• Configure web server rules to reject requests containing path traversal sequences
• Deploy network-level access controls to limit exposure of the BYOB server
• Consider running BYOB in a containerized environment with restricted filesystem permissions

# Example: Restrict filesystem permissions on critical database files
chmod 400 /path/to/byob/database.db
chown byob-service:byob-service /path/to/byob/database.db

# Example: iptables rule to restrict access to BYOB port
iptables -A INPUT -p tcp --dport 5000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP