CVE-2024-31848

published 2024-04-05

CVE-2024-31848: A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an…

Priority P2 77 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cdata	api_server	< 23.4.8844	23.4.8844

Detection & IOCs extracted from sources · hover to see the quote

path /src/getSettings.rsb↗

command GET /ui/..\src\getSettings.rsb?@json HTTP/1.1↗

sigma↗

shodan-query: "title:\"CData Connect\""

• → Detect path traversal attempts using backslash characters in URIs targeting /ui/..\src\getSettings.rsb — Jetty does not reject \ characters in URIs unlike Tomcat, making this the key exploit vector. ↗
• → Alert on HTTP 200 responses to requests for /ui/..\src\getSettings.rsb?@json containing JSON body fields 'items', 'notifyemail', and ':\"true\"' — these indicate successful unauthenticated settings disclosure. ↗
• → Inspect HTTP responses for Content-Disposition: attachment; filename=GetSettings.json header, which indicates successful exfiltration of application settings via path traversal. ↗
• → Flag requests where the URI contains a backslash sequence (e.g., /ui/..\src\) targeting CData API Server or CData Connect — this bypasses security constraints defined in web.xml as processed by the embedded Jetty server. ↗

• · The path traversal exploit only works when CData API Server is deployed using the embedded Jetty server. Deployments on Tomcat are NOT vulnerable because Tomcat rejects backslash characters in URIs. ↗
• · The vulnerability requires the Java version of CData API Server specifically; the embedded Jetty server version is the critical deployment condition for exploitability. ↗
• · The exploit succeeds because CData applications lacked explicit session checks on a number of endpoints, compounding the path traversal issue — patching the traversal alone may not be sufficient if session validation is not enforced. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22