YouDataSum CPAS V4 Unauthenticated Arbitrary File Read CVSS 8.7
Attackers can read arbitrary system files in YouDataSum CPAS V4 without authentication by manipulating a specific download parameter.
Key points
- CVSS score is 8.7, rated high severity by NVD.
- Vulnerability allows reading of sensitive files like /etc/passwd.
- Exploitation evidence was first observed in January 2025.
YouDataSum CPAS Audit Management System V4 contains a high-severity path traversal flaw. This vulnerability enables unauthenticated attackers to read arbitrary files on the server. The issue stems from improper validation of user-supplied input in a specific controller endpoint. The Shadowserver Foundation observed exploitation evidence against internet-facing instances of this software.
Root cause
The core issue is a CWE-22 path traversal weakness within the application logic. The system fails to sanitise the fileId parameter before using it to locate files for download. This lack of validation allows an attacker to inject directory traversal sequences, such as ../, into the request. Consequently, the application interprets the manipulated path as pointing to locations outside the intended directory structure, exposing sensitive system data.
Attack path
An attacker initiates the exploit by sending a GET request to /cpasm4/plugInManController/downPlugs. They manipulate the fileId parameter to include sequences like ../../etc/passwd. Because the system does not restrict the path scope, it retrieves and returns the contents of the targeted file to the requester. This process requires no authentication credentials, making it accessible to any external actor with network access to the service.
Affected versions
- YouDataSum CPAS Audit Management System V4
Mitigation
- Restrict external access to the CPAS web interface using firewall rules.
- Implement strict input validation for file path parameters at the WAF.
- Monitor logs for unusual file download requests containing traversal sequences.
- Isolate vulnerable instances from public networks to reduce exposure.
Signals worth monitoring
Security operations teams should examine web server access logs for GET requests targeting the downPlugs controller. Look specifically for payloads containing directory traversal sequences like ../ within the fileId parameter. Alert on successful responses to these requests, as they indicate data exfiltration. Check for repeated attempts from diverse source IP addresses, which may signal automated scanning. Verify that authentication logs show no user activity for these requests, confirming unauthenticated access.
What to do and how to stay safe: YouDataSum
- Review web application firewall rules to block requests containing directory traversal patterns.
- Audit current network segmentation to ensure the CPAS interface is not publicly accessible.
- Monitor access logs for the specific controller endpoint for any anomalous file retrieval.
- Coordinate with the vendor to determine if a patched version is available for deployment.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The NVD rates CVE-2024-58396 with a CVSS score of 8.7, classified as high severity.
Can attackers write files or execute code?
No, the source material only describes the ability to read arbitrary files like /etc/passwd.
When was exploitation first observed?
The Shadowserver Foundation first observed exploitation evidence on 13 January 2025.
