CVE-2024-54909
Published: 06 February 2025
Summary
CVE-2024-54909 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-54909 is a path traversal vulnerability (CWE-22) in GoldPanKit eva-server version 4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter enables arbitrary file downloads. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality and integrity.
An attacker requires low privileges (PR:L) to exploit this issue remotely over the network without user interaction. By crafting a malicious path parameter, the attacker can traverse directories and download arbitrary files from the server, potentially exposing sensitive data or enabling further compromise through integrity violations.
Mitigation details are available in the referenced GitHub issue at https://github.com/goldpankit/eva-springboot2/issues/2, published on 2025-02-06.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52691
Vulnerability details
A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing API endpoint directly enables remote exploitation of the application (T1190) and arbitrary local file access/download (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates input validation at the /api/resource/local/download endpoint to reject or sanitize path parameters containing directory traversal sequences like '../', directly preventing arbitrary file downloads.
AC-6 enforces least privilege on the eva-server process, restricting filesystem access to only authorized directories and files even if path traversal succeeds.
SI-2 requires timely identification, reporting, and correction of the path traversal flaw in GoldPanKit eva-server v4.1.0, eliminating the vulnerability through patching.