Goultarde/CVE-2024-46987

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that authenticates to a Camaleon CMS instance and exploits a path traversal vulnerability in the download_private_file endpoint to read arbitrary files from the server.

Backdoor review

No backdoor observed in reviewed code

The PoC script performs only the advertised authenticated path traversal against Camaleon CMS. It logs in, retrieves a CSRF token, and reads a user-specified file via the vulnerable endpoint. No hidden network calls, persistence mechanisms, credential exfiltration, or unrelated payloads are present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwarecamaleon-cms
Attack typespath traversalinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by authenticating and then sending a crafted request to read arbitrary files, which is the definition of an exploit. It does not merely check for the vulnerability's existence.

CVE-2024-46987.py:53-66README.md:3

Requirements

  • Requires valid credentials for a Camaleon CMS user account.CVE-2024-46987.py:11-14README.md:9
  • Requires Python 3.x and the 'requests' library.README.md:19-20

Observed behavior

  • Logs into the Camaleon CMS admin panel by fetching a CSRF token and submitting credentials.CVE-2024-46987.py:24-51
  • Constructs a URL with a path traversal sequence (../../../../../../../../../..) prepended to a user-supplied file path and sends a GET request to the vulnerable endpoint.CVE-2024-46987.py:53-66
  • Prints the raw content of the retrieved file to standard output.CVE-2024-46987.py:61-62
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
self.urlTarget URL is supplied by the user via command-line argument; no hardcoded external host.CVE-2024-46987.py:11-12
Credential Handling
user and password argumentsCredentials are used only for local authentication to the target CMS; they are not sent to any third party.CVE-2024-46987.py:38-44
File Operation
read_file methodReads a file from the target server via the LFI endpoint and prints the content to stdout; no local file write or exfiltration to external host.CVE-2024-46987.py:53-66
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1