CVE-2024-7601: Logsign Path Traversal Vulnerability

CVE-2024-7601 Overview

CVE-2024-7601 is a directory traversal vulnerability in the Logsign Unified SecOps Platform that allows authenticated remote attackers to delete arbitrary files on the underlying system. The flaw resides in the data_export_delete_all handler exposed through the HTTP API service, which listens on TCP port 443 by default. The service fails to validate a user-supplied path before performing file operations, allowing attackers to escape the intended directory. Successful exploitation results in arbitrary file deletion in the context of the root user. The Zero Day Initiative tracked this issue as ZDI-CAN-25026.

Critical Impact
Authenticated attackers can delete arbitrary files as root, enabling data destruction, denial of service against the SecOps platform, and disruption of security operations that rely on Logsign for logging and detection.

Affected Products

Logsign Unified SecOps Platform version 6.4.20
Logsign Unified SecOps Platform versions prior to 6.4.23
Deployments exposing the HTTP API service on TCP port 443

Discovery Timeline

2024-08-21 - CVE-2024-7601 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7601

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-22] in the Logsign Unified SecOps Platform HTTP API. An authenticated user can invoke the data_export_delete_all functionality with a crafted path parameter containing traversal sequences such as ../. The service concatenates this input into a filesystem path and then performs a delete operation without canonicalizing or restricting the resulting location.

Because the Logsign service runs as root, the delete operation executes with full privileges over the host filesystem. Attackers can remove configuration files, log archives, database files, or system binaries. Destroying log data on a security operations platform undermines incident response and forensic activity across the environment.

Exploitation requires authentication and network access to the HTTPS management interface. The attack complexity is low, and no user interaction is required beyond a valid session.

Root Cause

The root cause is missing input validation on a user-supplied file path prior to its use in a delete file operation. The application accepts relative path traversal sequences and does not enforce a base directory constraint or reject dangerous characters. This maps directly to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

An authenticated remote attacker sends a crafted HTTP request to the data_export_delete_all endpoint on TCP port 443. The request includes a path parameter with directory traversal sequences pointing outside the intended export directory. The service resolves the path and deletes the target file as root. Chaining this with other flaws or targeting authentication material could enable broader compromise.

No verified public proof-of-concept is available. Refer to the Zero Day Initiative Advisory ZDI-24-1106 for technical details.

Detection Methods for CVE-2024-7601

Indicators of Compromise

HTTP requests to the Logsign API containing data_export_delete_all combined with path traversal sequences such as ../, ..%2f, or absolute paths
Unexpected deletion of files under /etc, /var/log, /opt/logsign, or other system directories on the Logsign host
Gaps in Logsign audit and telemetry logs coinciding with API activity from authenticated sessions
Authenticated sessions originating from unexpected source IPs invoking export management endpoints

Detection Strategies

Inspect Logsign HTTPS access logs for requests to export-related API endpoints containing traversal characters or encoded variants
Correlate authenticated API activity against expected administrator source IPs and time windows
Monitor filesystem integrity on the Logsign appliance using tooling such as auditd or AIDE to flag deletions of critical files

Monitoring Recommendations

Forward Logsign application, web server, and OS audit logs to an external SIEM or data lake so that log tampering on the appliance itself does not blind defenders
Alert on unexpected unlink or rmdir syscalls executed by the Logsign service account or root context
Track configuration changes and file deletions on Logsign hosts and require review for any activity outside change windows

How to Mitigate CVE-2024-7601

Immediate Actions Required

Upgrade Logsign Unified SecOps Platform to version 6.4.23 or later as documented in the vendor release notes
Restrict network access to the Logsign HTTPS management interface to trusted administrative networks only
Rotate credentials for all accounts with API access and audit account activity for signs of misuse
Review the appliance for missing or deleted files and restore from backup where necessary

Patch Information

Logsign resolved this vulnerability in version 6.4.23. See the Logsign Release Notes 6.4.23 for the official fix. Administrators should apply the update through the standard Logsign upgrade process and verify the running version after deployment.

Workarounds

Place the Logsign management interface behind a VPN or bastion host so that only authenticated administrators on trusted networks can reach TCP port 443
Enforce strong authentication and least-privilege role assignments to reduce the population of accounts able to reach the vulnerable endpoint
Enable filesystem integrity monitoring and offsite log shipping so that arbitrary deletion on the appliance is detected and reconstructable

bash

# Example: restrict access to the Logsign HTTPS API to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP