CVE-2024-45241: CentralSquare CryWolf Path Traversal

Responsible disclosure

This research was carried out by Solusec and published after coordinated disclosure, with a CVE identifier assigned through the appropriate numbering authority. It is shared for defensive and educational purposes so that affected operators can identify and remediate the issue. We do not publish research to enable misuse.

If you operate an affected product and want help confirming or fixing this, get in touch.

Summary

A path traversal vulnerability in CentralSquare's CryWolf (False Alarm Management) application lets unauthenticated attackers read files outside the working web directory, leading to disclosure of sensitive information.

This vulnerability is tracked as CVE-2024-45241. The authoritative record is on the CVE List (CVE-2024-45241), with severity metrics on the National Vulnerability Database.

Technical detail

The rpt parameter on GeneralDocs.aspx accepts a traversal payload. The referenced file is then retrieved via gdoc1.ashx, with the ASP.NET_SessionId cookie tying the second request to the first.

Step 1 — visit the traversal URL in a proxied browser:

GET /GeneralDocs.aspx?rpt=../web.config HTTP/1.1

Step 2 — locate the subsequent GET request to gdoc1.ashx in the proxy; its response returns the full contents of the requested file. The session cookie set by the first request determines what the second request returns.

Impact

Unauthenticated disclosure of files outside the web root, including application configuration such as web.config, which commonly contains connection strings and other secrets. That material frequently enables further compromise of the application or its backend.

Remediation

Canonicalise and validate the rpt parameter, rejecting any path that resolves outside the intended document directory.
Map document requests to an allow-list of known reports rather than accepting a path.
Ensure sensitive files are never served through the document-retrieval handler.

Common questions

What is CVE-2024-45241?

A path traversal vulnerability in CentralSquare's CryWolf False Alarm Management application. The rpt parameter on GeneralDocs.aspx allows unauthenticated reading of files outside the web directory, retrieved via gdoc1.ashx.

What can an attacker access?

Files outside the web root, including configuration such as web.config, which often holds connection strings and other secrets that enable further compromise.

Does it require a login?

No. The disclosure can be triggered by an unauthenticated attacker; a session cookie simply links the two requests involved.

How should it be fixed?

Canonicalise and validate the path, reject anything resolving outside the intended directory, and prefer an allow-list of known documents over accepting a path from the client.

CVE-2024-45241: Path Traversal in CentralSquare's CryWolf