CVE-2024-55457: MasterSAM Star Gate Path Traversal Flaw

CVE-2024-55457 Overview

MasterSAM Star Gate 11 contains a directory traversal vulnerability [CWE-22] in the /adama/adama/downloadService endpoint. Attackers can manipulate the file parameter to read arbitrary files from the underlying server file system. Successful exploitation exposes configuration files, credentials, and other sensitive data stored on the host. The flaw requires no authentication and is reachable over the network, expanding the pool of potential attackers to anyone who can reach the application.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from a MasterSAM Star Gate 11 server by traversing outside the intended download directory.

Affected Products

MasterSAM Star Gate 11
Deployments exposing the /adama/adama/downloadService endpoint
Any Star Gate 11 instance reachable from untrusted networks

Discovery Timeline

2025-02-20 - CVE-2024-55457 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55457

Vulnerability Analysis

The vulnerability resides in the downloadService handler within the /adama/adama/ path of MasterSAM Star Gate 11. The service accepts a file parameter that identifies which file to return to the requester. The handler does not properly validate or canonicalize the supplied path before opening it. Attackers supply relative traversal sequences such as ../ to break out of the intended download directory and reach arbitrary locations on the file system.

The issue is a classic path traversal weakness cataloged as [CWE-22]. Because the endpoint runs without authentication, exploitation requires only network access to the vulnerable service. Successful requests return the raw contents of the targeted file, which may include operating system configuration, application secrets, session tokens, or credential material used by Star Gate itself. A public proof of concept is available in the GitHub PoC Repository.

Root Cause

The root cause is missing input validation on the file parameter. The service concatenates user-supplied input into a file path without stripping traversal sequences, enforcing an allow list of files, or restricting resolution to a chroot-style base directory. Standard defenses such as path canonicalization followed by a prefix check against the intended base directory are absent.

Attack Vector

An attacker sends a crafted HTTP GET request to /adama/adama/downloadService with a file parameter containing traversal sequences. For example, a request supplying ../../../../etc/passwd on Linux or ..\..\..\Windows\win.ini on Windows causes the server to return the referenced file. No credentials, user interaction, or prior foothold are required. Refer to the GitHub PoC Repository for exploitation details.

Detection Methods for CVE-2024-55457

Indicators of Compromise

HTTP requests to /adama/adama/downloadService containing ../ or URL-encoded variants such as %2e%2e%2f in the file parameter
Responses from the downloadService endpoint returning content types or file sizes inconsistent with expected downloads
Access log entries showing sequential probing of the file parameter with sensitive paths such as /etc/passwd, /etc/shadow, or web.xml

Detection Strategies

Deploy web application firewall rules that inspect the file query parameter for traversal patterns and encoded equivalents
Baseline normal downloadService usage and alert on parameter values that deviate from known-good filenames
Correlate high volumes of downloadService requests from a single source with successful HTTP 200 responses to identify enumeration attempts

Monitoring Recommendations

Forward Star Gate 11 web access logs to a centralized log platform and retain them for incident response
Monitor outbound data volume from the Star Gate host to detect bulk exfiltration of read files
Alert on process-level access to sensitive files by the Star Gate service account outside expected patterns

How to Mitigate CVE-2024-55457

Immediate Actions Required

Restrict network access to /adama/adama/downloadService to trusted management networks using firewall or reverse proxy rules
Review web server access logs for prior exploitation attempts referencing the file parameter with traversal sequences
Rotate credentials, keys, and secrets that may have been stored in files accessible from the Star Gate host

Patch Information

No vendor advisory or fixed version is listed in the NVD entry at the time of publication. Contact MasterSAM directly for remediation guidance and to confirm whether a patched build of Star Gate 11 is available. Track updates through the NVD entry for CVE-2024-55457.

Workarounds

Place the Star Gate 11 application behind a reverse proxy that blocks requests to /adama/adama/downloadService containing .., %2e%2e, or other traversal indicators
Apply operating system access controls so the Star Gate service account cannot read sensitive files outside its required working directory
Disable or firewall the downloadService endpoint entirely if the download functionality is not required in your deployment

bash

# Example NGINX reverse proxy rule to block traversal attempts
location /adama/adama/downloadService {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://stargate_backend;
}