CVE-2024-58387: Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/modelreport/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Inspur Haiyue HCM Cloud deployments whose /api/model_report/file/download endpoint is reachable over the network are exposed. The issue can be exploited remotely without authentication or user interaction.
What does an attacker need to exploit it?
An attacker only needs to send a crafted request to the file download endpoint with path values supplied through the index and ext parameters. The described request form uses index=/ and ext set to a target filesystem path.
What could an attacker obtain?
The vulnerability permits reading arbitrary files from the affected server. Examples identified include /etc/passwd, application database files, and system configuration files.
How can I check for attempted exploitation?
Review web or application logs for requests to /api/model_report/file/download, especially requests containing index=/ or ext values that name filesystem paths. Exploitation evidence was first observed on 2024-11-04.