CVE-2024-48823: Automatic Systems SlimLane LFI

Responsible disclosure

This research was carried out by Solusec and published after coordinated disclosure, with a CVE identifier assigned through the appropriate numbering authority. It is shared for defensive and educational purposes so that affected operators can identify and remediate the issue. We do not publish research to enable misuse.

If you operate an affected product and want help confirming or fixing this, get in touch.

Summary

The PassageAutoServer.php page on the affected Automatic Systems SlimLane build accepts a file parameter that is used to read files from disk without adequate restriction. By supplying an absolute path, an unauthenticated attacker can read files outside the web directory — a local file inclusion / path disclosure issue.

This vulnerability is tracked as CVE-2024-48823. The authoritative record is on the CVE List (CVE-2024-48823), with severity metrics on the National Vulnerability Database.

Technical detail

The getImg and file parameters can be pointed at sensitive system files:

GET /PassageAutoServer.php?getImg=1&file=/etc/passwd HTTP/1.1
Host: <IP>
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.120 Safari/537.36
Connection: keep-alive

The server returns the contents of the requested file, confirming that the parameter is used to build a filesystem path with no effective containment to the intended directory.

Impact

Disclosure of arbitrary readable files on the device: configuration, credentials, and operating-system files that assist further attacks. On an embedded access-control device this is often enough to recover secrets that unlock the rest of the system.

Remediation

Never pass user input directly into filesystem calls. Map requests to a fixed allow-list of permitted resources.
Canonicalise and validate any path, rejecting absolute paths and traversal sequences.
Run the service with least privilege so that even a successful read is limited in scope.

Common questions

What is CVE-2024-48823?

A local file inclusion vulnerability in PassageAutoServer.php on an Automatic Systems SlimLane build. The file parameter is used to read files without restriction, allowing access to files outside the web root.

Does it require authentication?

No. The read can be performed by an unauthenticated attacker who can reach the endpoint over the network.

What could an attacker read?

Any file the service account can read, including configuration and operating-system files that may contain or lead to credentials.

How is it fixed?

Replace direct path handling with an allow-list of permitted resources, canonicalise and validate input, and apply least-privilege to the service.

CVE-2024-48823: Local File Inclusion in Automatic Systems SlimLane (PassageAutoServer.php)