CVE-2024-7600: Logsign SecOps Path Traversal Vulnerability

CVE-2024-7600 Overview

CVE-2024-7600 is a directory traversal vulnerability in Logsign Unified SecOps Platform that allows authenticated remote attackers to delete arbitrary files. The flaw resides in the HTTP API service listening on TCP port 443 by default. Improper validation of a user-supplied path enables attackers to break out of the intended directory and remove files with root privileges. The Zero Day Initiative tracks this issue as ZDI-CAN-25025 and published advisory ZDI-24-1103. Logsign addressed the flaw in version 6.4.23. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can delete arbitrary files as root, degrading SIEM integrity and enabling denial of service against the security operations platform itself.

Affected Products

Logsign Unified SecOps Platform version 6.4.20
Earlier Logsign Unified SecOps Platform releases prior to 6.4.23
Deployments exposing the HTTP API service on TCP port 443

Discovery Timeline

2024-08-21 - CVE-2024-7600 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7600

Vulnerability Analysis

The vulnerability exists in the HTTP API service of Logsign Unified SecOps Platform. The API accepts a path parameter that is used directly in file deletion operations. Because the service does not canonicalize or restrict the supplied path, attackers can inject traversal sequences such as ../ to reach files outside the intended directory. Successful exploitation removes arbitrary files with root privileges, since the API process runs as root. An attacker with any valid authenticated session can trigger the flaw over the network without user interaction. Deleting critical configuration files, log stores, or system binaries can disable the SIEM, destroy forensic evidence, or render the appliance unbootable.

Root Cause

The root cause is missing input validation on a user-supplied filesystem path prior to invoking a delete operation. The service does not enforce an allow-list of directories, does not resolve symbolic links safely, and does not reject traversal metacharacters. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation is network-based and requires authentication with low privileges. An attacker sends a crafted HTTPS request to the vulnerable API endpoint on TCP port 443 with a path parameter containing directory traversal sequences. The backend resolves the traversed path and unlinks the referenced file under the root account. No user interaction and no additional privileges beyond authentication are required. See the Zero Day Initiative Advisory ZDI-24-1103 for the coordinated disclosure record.

No public proof-of-concept exploit code is available at time of writing.

Detection Methods for CVE-2024-7600

Indicators of Compromise

HTTPS requests to the Logsign API on TCP port 443 containing ../ or URL-encoded traversal sequences (%2e%2e%2f, ..%2f) in path parameters.
Unexpected file deletion events in /etc, /var/log, /opt/logsign, or other system directories on the appliance.
Sudden loss of log ingestion, dashboard failures, or service crashes correlated with API activity from a single authenticated session.

Detection Strategies

Inspect Logsign API access logs for requests referencing file paths outside the expected working directories.
Deploy Web Application Firewall (WAF) rules that reject path traversal patterns in query strings and JSON bodies destined for the Logsign API.
Enable filesystem auditing with auditd on the appliance to record unlink and unlinkat syscalls executed by the API service user.

Monitoring Recommendations

Alert on authenticated API sessions issuing file-management operations outside normal administrator workflows.
Correlate deletion events on the Logsign host with the source IP and account of concurrent API sessions.
Track version and patch state of Logsign Unified SecOps Platform in asset inventory to flag hosts running versions earlier than 6.4.23.

How to Mitigate CVE-2024-7600

Immediate Actions Required

Upgrade Logsign Unified SecOps Platform to version 6.4.23 or later as described in the Logsign 6.4.23 Release Notes.
Restrict network access to the management interface on TCP port 443 to trusted administrator networks.
Rotate credentials for all Logsign accounts and review recent authentication events for unauthorized access.

Patch Information

Logsign fixed CVE-2024-7600 in Unified SecOps Platform version 6.4.23, released on 06-08-2024. Administrators should apply the vendor-provided update per the Logsign Release Notes. The Zero Day Initiative Advisory ZDI-24-1103 confirms the patched version.

Workarounds

Place the Logsign appliance behind a reverse proxy or WAF that filters directory traversal metacharacters in API paths and parameters.
Limit accounts with API access to the minimum required and disable unused administrative users until the patch is applied.
Take a verified offline backup of Logsign configuration and log storage so that deleted artifacts can be restored after an incident.

bash

# Example WAF filter (ModSecurity) blocking traversal on the Logsign API
SecRule REQUEST_URI|ARGS|REQUEST_HEADERS "@rx (\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)" \
    "id:1007600,phase:2,deny,status:403,log,\
     msg:'CVE-2024-7600 Logsign path traversal attempt'"