CVE-2024-24809
Published: 10 April 2024
Summary
CVE-2024-24809 is a high-severity Path Traversal: 'dir/../../filename' (CWE-27) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Traccar, an open source GPS tracking system, is affected by path traversal and unrestricted file upload vulnerabilities (CWE-27 and CWE-434) in all versions prior to 6.0. The issues allow upload of files with dangerous types and arbitrary path control when the default self-registration feature is enabled.
An attacker who registers an ordinary user account can exploit the flaws to upload files prefixed with "device." into any folder on the server. This capability supports phishing, cross-site scripting, and potential remote command execution, as reflected in the CVSS 8.5 score that emphasizes network-accessible impact with low attack complexity.
The official GitHub Security Advisory GHSA-vhrw-72f6-gwp5 and the associated patch commit b099b298f90074c825ba68ce73532933c7b9d901 state that version 6.0 resolves the issue; administrators should upgrade promptly and consider disabling public registration if not required.
The EPSS score remains elevated near its peak of 0.9078, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22183
Vulnerability details
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering…
more
an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.