CVE-2024-55415

published 2025-01-30

CVE-2024-55415: DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.

Priority P3 45 medium 5.7 CVSS 3.1

AV N AC L PR L UI R S U C H I N A N

EXPLOIT

DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tcg	voyager	0 – 1.8.0	—
thecontrolgroup	voyager	<= 1.8.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /admin/compass↗

url /admin/compass?download={{base64('/etc/passwd')}}

other regex('root:.*:0:0:', body)

• → Detect path traversal attempts against the /admin/compass endpoint by monitoring for base64-encoded path strings in the 'download' query parameter.
• → A successful exploitation returns HTTP 200 with content matching 'root:.*:0:0:' in the response body, indicating /etc/passwd was read.
• → The path traversal flaw enables attackers to manipulate file paths and delete or access arbitrary files on the server. ↗
• → Monitor for HTTP 302 redirects from /admin/compass as an intermediate indicator during exploitation attempts.

• · Exploitation requires an authenticated Voyager admin session; the attacker must trick an authenticated user into clicking a malicious link (one-click attack vector). ↗
• · All versions through 1.8.0 are affected and no official patch exists; detections should cover all Voyager deployments up to and including 1.8.0. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22