CVE-2024-11303 Scanner

Korenix JetPort 5601 is a rugged industrial Ethernet device designed for industrial IoT connectivity. It is primarily used in industrial control systems, surveillance, and network communications. The device facilitates serial-to-Ethernet communication, ensuring robust performance in harsh environments. It is popular in sectors such as manufacturing, transportation, and automation. JetPort 5601 devices are designed for reliability, offering features like secure remote management and flexible networking options. However, certain versions of JetPort 5601 are affected by a serious vulnerability that can be exploited remotely.

The vulnerability allows attackers to perform a path traversal attack on affected Korenix JetPort 5601 devices. Path Traversal occurs when the software does not properly sanitize user inputs, allowing malicious users to navigate outside the intended directory structure. By exploiting this flaw, an attacker can access sensitive files and data, such as system files. This issue has been identified as a severe security risk and can lead to unauthorized access to the underlying system. It affects JetPort 5601 devices up to version 1.2. The vulnerability can be triggered by sending specially crafted requests to the device.

This vulnerability is triggered by a specially crafted HTTP GET request that manipulates the file path in a way that allows the attacker to access restricted files. The attacker can use encoded characters like '%2e%2e' to traverse directories and reach critical files such as '/etc/passwd'. The vulnerability is exposed through a web interface, making it accessible remotely. Once exploited, attackers can view or manipulate sensitive system files. This flaw is due to improper input validation on the server-side and is commonly found in web applications that allow file path manipulation.

If exploited, this vulnerability can lead to the disclosure of sensitive system files, such as password files. An attacker could gain unauthorized access to system-level files and potentially escalate privileges on the affected system. This could allow for further exploitation, including the installation of backdoors or the compromise of network integrity. Additionally, the ability to manipulate or steal sensitive data could have significant security and privacy implications. Attackers could also use this vulnerability to map the internal file structure, aiding in future attacks.

REFERENCES

• https://seclists.org/fulldisclosure/2024/Nov/8
• https://www.korenix.com/en/about/index.aspx?kind=3
• https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/