CVE-2024-24809 Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
Attackers can upload malicious files via path traversal to execute arbitrary commands or perform XSS, affecting Traccar GPS tracking systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24809?
CVE-2024-24809 is a high-severity vulnerability in traccar, published on 10 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Which versions are affected by CVE-2024-24809?
How do I fix CVE-2024-24809?
No fix has been published for CVE-2024-24809 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-24809 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24809 exists.
Public exploit code: 2 Metasploit modules, 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-vhrw-72f6-gwp5.