CVE-2024-41628 Scanner

Cluster Control by Severalnines is a management platform for database systems, used by organizations to monitor and manage their databases efficiently. It provides features for deployment, scaling, and automation of database operations. The software integrates with various databases to streamline management tasks and ensure high availability. It is widely used by businesses to maintain and optimize their database environments. Vulnerabilities in this software can lead to significant security risks if not addressed promptly.

The detected vulnerability is a Directory Traversal issue within Cluster Control. It allows an attacker to manipulate the API endpoint to include and display arbitrary files from the server. This can lead to unauthorized access to sensitive files on the server. The issue affects specific versions of the software, and its exploitation can compromise the confidentiality of the system.

The Directory Traversal vulnerability is present in the CMON API of Cluster Control. By sending specially crafted HTTP requests, an attacker can traverse directories and access sensitive files on the server. For example, a request such as GET /../../../../../../../../..//etc/passwd could be used to view the contents of the /etc/passwd file. The vulnerability is triggered by the way the API processes file paths without proper validation. This flaw is evident in versions prior to 1.9.8-9778, 2.0.0-9779, and 2.1.0-9780.

If exploited, this Directory Traversal vulnerability can allow attackers to access sensitive files, potentially exposing critical system information. Attackers could gain insight into system configurations, user credentials, or other confidential data. This exposure can lead to further attacks or unauthorized system modifications. In a worst-case scenario, it could facilitate a complete compromise of the affected system.

S4E's platform offers comprehensive security scanning and threat exposure management to safeguard your digital assets. By joining, you gain access to advanced vulnerability detection tools that identify critical issues like Directory Traversal vulnerabilities. Our platform helps you stay ahead of potential threats with continuous updates and expert insights. Enhance your security posture with our proactive solutions and ensure your systems are protected against evolving cyber threats. Sign up today to benefit from our state-of-the-art scanning capabilities.

References:

• https://cvefeed.io/vuln/detail/CVE-2024-41628
• https://github.com/Redshift-CyberSecurity/CVE-2024-41628
• https://vuldb.com/?id.272533
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-41628