CVE-2024-47769: IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47769?
The severity of CVE-2024-47769 is critical due to unauthorized access to public endpoints.
How do I fix CVE-2024-47769?
To fix CVE-2024-47769, update Idurar to version 4.1.1 or later to ensure proper authentication.
What type of vulnerability is CVE-2024-47769?
CVE-2024-47769 is an unauthenticated access vulnerability found in the corePublicRouter.js file.
Which versions of Idurar are affected by CVE-2024-47769?
Idurar versions up to and including 4.1.0 are affected by CVE-2024-47769.
What are the potential consequences of CVE-2024-47769?
Exploitation of CVE-2024-47769 could lead to unauthorized data access and manipulation in the Idurar application.