CVE-2024-51376
Published: 12 February 2025
Summary
CVE-2024-51376 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-51376 is a Directory Traversal vulnerability (CWE-22) in yeqifu carRental version 1.0. The flaw exists in the file/downloadFile.action?path= component, enabling a remote attacker to obtain sensitive information. It was published on 2025-02-12 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with no impact on integrity or availability.
A remote attacker requires only network access to exploit this vulnerability, with low attack complexity, no privileges, and no user interaction needed. Exploitation allows the attacker to traverse directories and access sensitive files on the affected system, potentially exposing configuration data, user information, or other confidential resources.
Advisories and further details on the vulnerability, including potential mitigation steps, are available in the referenced GitHub repositories: https://github.com/echo0d/vulnerability/blob/main/yeqifu_carRental/DirectoryTraversal.md and https://github.com/yeqifu/carRental/issues/43.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4913
Vulnerability details
Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFile.action?path= component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing web app directly enables remote file access (T1190) and local data collection (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the user-supplied 'path' parameter in file/downloadFile.action to block directory traversal sequences like '../', preventing unauthorized access to sensitive files.
Enforces approved access authorizations on file system resources to restrict the application from reading sensitive files outside the intended directory despite traversal attempts.
Implements boundary protection at external interfaces, such as web application firewalls, to monitor and block incoming requests with path traversal payloads targeting the vulnerable endpoint.