Security Resilience

CVE-2024-21518

Auth Bypass in Opencart ≥ 4.0.0.0

Public PoCAuth BypassPath Traversal
Published
22 June 2024
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.14 97th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-21518 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Opencart Opencart. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA07:2025 Authentication Failures

EU & UK References

Vulnerability Data

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted…

more

to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.

CWE(s)
CWE-29CWE-22CWE-290

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-2315Same product: Opencart Opencart
CVE-2026-10732Shared CWE-22, CWE-29
CVE-2023-1177Shared CWE-22, CWE-29
CVE-2023-6021Shared CWE-22, CWE-29
CVE-2024-21542Shared CWE-22, CWE-29
CVE-2023-0104Shared CWE-22, CWE-29
CVE-2024-51534Shared CWE-22, CWE-29
CVE-2026-30828Shared CWE-22, CWE-29
CVE-2024-3429Shared CWE-22, CWE-29
CVE-2024-13059Shared CWE-22, CWE-29

Affected Assets

opencart
opencart
≥ 4.0.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V5.3.2
  • V6.4.3
  • V10.4.16
  • V11.4.3

Mitigating Controls (NIST 800-53 r5) AI

IA-2 Identification and Authentication (Organizational Users) good match

Proper unique identification and authentication of users directly stops spoofing-based bypass of authentication.

IA-3 Device Identification and Authentication good match

Device identification and authentication before connection prevents spoofing of devices to bypass auth.

IA-8 Identification and Authentication (Non-organizational Users) good match

Authentication of non-organizational users blocks external spoofing attempts against the scheme.

AC-3 Access Enforcement good match

Enforces the intended directory access authorizations that path traversal would otherwise bypass.

IA-5 Authenticator Management good match

Authenticator management ensures credentials cannot be easily spoofed or reused to bypass authentication.

SI-10 Information Input Validation good match

Input validation directly neutralizes the '\..\filename' sequence before pathname resolution occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-02 partial match
blocks

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

PR.AA-03 partial match
blocks

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

PR.AA-04 partial match
blocks

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

PR.PS-02 partial match
blocks

Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.

PR.AA-05 none match
blocks

PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.5.33 Protection of records partial match
removes

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248827 OL 8 must not have the rsh-server package installed. blocks CWE-290
RHEL 7 (1 rule)
  • V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. blocks CWE-290
RHEL 8 (1 rule)
  • V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-290

References