CVE-2024-47769: Idurar ERP Path Traversal Vulnerability

CVE-2024-47769 Overview

CVE-2024-47769 is a path traversal vulnerability [CWE-22] in IDURAR, an open source Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) accounting and invoicing platform. The flaw resides in corePublicRouter.js, where user-supplied input is concatenated directly into a join statement without sanitization. Because the affected endpoint is exposed to unauthenticated users, attackers can send URL-encoded payloads that escape the intended directory and read arbitrary files on the host filesystem. The vulnerability is network-exploitable, requires no privileges, and has no user interaction requirement.

Critical Impact
Unauthenticated remote attackers can read sensitive system files by submitting URL-encoded traversal sequences to a public endpoint in IDURAR.

Affected Products

IDURAR ERP CRM (idurarapp/idurar)
Deployments using vulnerable corePublicRouter.js route handlers
Self-hosted IDURAR instances exposed to untrusted networks

Discovery Timeline

2024-10-04 - CVE-2024-47769 published to NVD
2024-10-04 - Vendor commit 949bc6f published in the idurar-erp-crm repository
2024-11-13 - Last updated in NVD database

Technical Details for CVE-2024-47769

Vulnerability Analysis

The vulnerability is a classic path traversal flaw in the IDURAR public router. The corePublicRouter.js file defines a route that resolves files based on a subpath segment derived from request input. The handler appends the user-controlled value to a base path through path.join without normalizing or validating the resulting location. Because the route is registered under the public router, no authentication check intercepts the request before file resolution executes.

Attackers exploit this by submitting URL-encoded ../ sequences in the subpath. The server decodes the payload, joins it to the base directory, and returns the contents of the resolved file. This allows disclosure of configuration files, environment files, source code, and operating system artifacts accessible to the IDURAR process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The handler trusts user input as a relative path component and does not enforce that the canonicalized result remains inside the intended asset directory. There is no allowlist, no canonical path check, and no rejection of traversal metacharacters.

Attack Vector

Exploitation occurs over the network against the public HTTP endpoint. An attacker crafts a request whose subpath parameter contains URL-encoded directory traversal sequences such as %2e%2e%2f chained to a target file path. The server responds with the file contents if the IDURAR process has read access. No credentials or user interaction are required.

No verified public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-948g-2vm7-mfv7 for the vendor's technical description.

Detection Methods for CVE-2024-47769

Indicators of Compromise

HTTP requests to IDURAR public endpoints containing URL-encoded traversal sequences such as %2e%2e%2f, ..%2f, or %2f..
Web server access logs showing 200 responses to public router paths with abnormally long or encoded subpath segments
Outbound responses from IDURAR returning content of files outside the application's static asset directory
Process-level reads of /etc/passwd, .env, or application configuration files originating from the Node.js IDURAR process

Detection Strategies

Inspect reverse proxy and Node.js access logs for decoded path components containing ../ after URL decoding
Deploy web application firewall rules that block traversal patterns targeting IDURAR public routes
Monitor file integrity and read access to sensitive paths from the IDURAR service account

Monitoring Recommendations

Forward IDURAR application logs and reverse proxy logs into a centralized analytics platform for traversal pattern detection
Alert on repeated 4xx responses followed by a successful 200 on the same public endpoint, indicating payload tuning
Track anomalous file system reads by the IDURAR Node.js process outside its working directory

How to Mitigate CVE-2024-47769

Immediate Actions Required

Update IDURAR to the version that includes commit 949bc6fe31f3175c9e1864d30cf6c8110179ac14
Restrict network exposure of IDURAR instances to trusted users and place the application behind authenticated access where possible
Audit web and application logs for prior traversal attempts and identify any files that may have been disclosed
Rotate secrets, API keys, and credentials stored in configuration files if exposure is suspected

Patch Information

The maintainers addressed the vulnerability in the idurar-erp-crm repository through commit 949bc6fe31f3175c9e1864d30cf6c8110179ac14. The fix validates and normalizes the subpath input before it is joined to the base directory. Review the vendor commit and the GHSA-948g-2vm7-mfv7 advisory for upgrade guidance.

Workarounds

Place a reverse proxy or web application firewall in front of IDURAR and block requests containing encoded or literal ../ sequences in the public router path
Run the IDURAR process under a dedicated low-privilege user account with read access limited to required application directories
Disable or restrict the affected public endpoint at the proxy layer until the patched version is deployed

bash

# Example NGINX rule to block traversal payloads to IDURAR public routes
location /api/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://idurar_backend;
}