Exploitation Summary
EIP tracks 3 public exploits for CVE-2024-24809.
PoCs published by gh-ost00, Michael Heinzl, yiliufeng168, Naveen Sunkavally, Michael Heinzl, Zach Hanley, Enrique Castillo, Brian Hysell, including Metasploit module exploits/linux/http/traccar_rce_upload.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-24809, an authentication bypass and path traversal vulnerability in Traccar GPS tracking system. The exploit demonstrates user registration, login, device creation, and file upload with path traversal to achieve arbitrary file write.
Description
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Exploits (3)
This repository contains a functional exploit for CVE-2024-24809, an authentication bypass and path traversal vulnerability in Traccar GPS tracking system. The exploit demonstrates user registration, login, device creation, and file upload with path traversal to achieve arbitrary file write.
This Metasploit module exploits CVE-2024-24809 and CVE-2024-31214 in Traccar v5.1-v5.12 by combining path traversal and unrestricted file upload to achieve remote code execution via cronjob manipulation.
This Metasploit module exploits CVE-2024-5910 (admin password reset) and CVE-2024-9464 (authenticated OS command injection) in Palo Alto Expedition to achieve remote code execution. It includes authentication handling, CSRF token retrieval, and command execution via cron job manipulation.
Nuclei Templates (1)
html:"Traccar"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L