CVE-2024-7603 Overview
CVE-2024-7603 is a directory traversal vulnerability in Logsign Unified SecOps Platform that allows authenticated remote attackers to delete arbitrary directories on affected installations. The flaw resides in the HTTP API service listening on TCP port 443 by default. The service fails to properly validate user-supplied path input before using it in file operations. An attacker with valid credentials can traverse outside the intended directory and delete filesystem locations in the context of root. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-25028 and tracked as ZDI-24-1105. It is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated attackers can delete arbitrary directories as root, enabling data destruction, log tampering, and denial of service against the SecOps platform itself.
Affected Products
- Logsign Unified SecOps Platform version 6.4.20
- Logsign Unified SecOps Platform versions prior to 6.4.23
- HTTP API service exposed on TCP port 443
Discovery Timeline
- 2024-08-21 - CVE-2024-7603 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7603
Vulnerability Analysis
The vulnerability exists in the HTTP API service of Logsign Unified SecOps Platform. The service accepts a path parameter from authenticated users and passes it to file deletion routines without sufficient sanitization. Because the API executes with root privileges, any successful traversal grants filesystem-wide deletion capability.
An attacker supplying path segments such as ../ can escape the intended working directory. The deletion operation then targets an arbitrary location on the underlying host. This behavior aligns with classic directory traversal patterns catalogued under [CWE-22].
Exploitation requires valid authentication, so the practical attack surface includes low-privileged operator accounts, compromised credentials, and insider threats. The impact on the SIEM platform itself is significant because Logsign stores security telemetry, correlation rules, and forensic evidence that adversaries may seek to destroy.
With an EPSS probability of 2.016% (79.4th percentile), the vulnerability shows measurable exploitation interest relative to the broader CVE population.
Root Cause
The HTTP API endpoint accepts a user-controlled path string and forwards it to a directory removal function without canonicalizing the path or restricting it to an allow-listed base directory. The absence of path normalization and boundary checks allows traversal sequences to resolve outside the intended scope.
Attack Vector
Exploitation occurs over the network against the HTTPS API on TCP port 443. The attacker authenticates to the platform, then issues a crafted API request containing a traversal payload in the path parameter. The server resolves the path relative to a base directory but does not reject .. segments, causing the deletion routine to remove a directory chosen by the attacker. No user interaction is required.
No public proof-of-concept code has been released. Refer to the Zero Day Initiative advisory ZDI-24-1105 for the vendor-coordinated disclosure details.
Detection Methods for CVE-2024-7603
Indicators of Compromise
- API requests to the Logsign HTTPS service on TCP port 443 containing ../, ..%2f, or URL-encoded traversal sequences in path parameters
- Unexpected disappearance of directories under /var/log, /opt/logsign, /etc, or other system paths on Logsign hosts
- Authenticated API sessions from non-administrative accounts issuing file or directory management calls
- Sudden gaps in Logsign ingestion, correlation output, or dashboard availability following an API call
Detection Strategies
- Inspect HTTP request logs for the Logsign API and alert on path parameters containing traversal tokens (.., %2e%2e, %252e).
- Correlate authentication events with subsequent filesystem changes on the Logsign appliance to identify anomalous deletion activity.
- Monitor process telemetry for unlink, rmdir, and rm -r operations executed by the Logsign API service against paths outside its expected working directories.
Monitoring Recommendations
- Enable verbose audit logging on the Logsign HTTP API and forward logs to an external SIEM or data lake to preserve evidence if local logs are deleted.
- Baseline normal API usage per account and alert on deviations such as unusual endpoints, request volume, or off-hours activity.
- Deploy file integrity monitoring on critical directories of the Logsign host to detect unauthorized deletions in near real time.
How to Mitigate CVE-2024-7603
Immediate Actions Required
- Upgrade Logsign Unified SecOps Platform to version 6.4.23 or later as documented in the 6.4.23 release notes.
- Rotate credentials for all Logsign platform accounts, especially service and operator accounts with API access.
- Review authentication and API access logs for evidence of exploitation dating back to before the patch was applied.
- Restrict network reachability of TCP port 443 on Logsign appliances to trusted management networks only.
Patch Information
Logsign addressed the vulnerability in Unified SecOps Platform version 6.4.23. The fix introduces proper validation of user-supplied paths before they are passed to filesystem operations. Administrators running version 6.4.20 or earlier should upgrade immediately. Consult the Logsign 6.4.23 release notes for upgrade procedures and post-upgrade validation steps.
Workarounds
- Place the Logsign management interface behind a reverse proxy or WAF that blocks requests containing directory traversal sequences.
- Enforce least-privilege role assignments so only trusted administrators hold API accounts capable of invoking file management endpoints.
- Take verified backups of Logsign configuration, correlation rules, and ingested data before applying patches, and store the backups off the appliance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
