CVE-2024-48824: Automatic Systems Monitoring Panel LFI

Responsible disclosure

This research was carried out by Solusec and published after coordinated disclosure, with a CVE identifier assigned through the appropriate numbering authority. It is shared for defensive and educational purposes so that affected operators can identify and remediate the issue. We do not publish research to enable misuse.

If you operate an affected product and want help confirming or fixing this, get in touch.

Summary

The download-file.php endpoint in the affected Automatic Systems Monitoring Panel builds a file path from two request parameters — a directory (Racine) and a filename (FileName) — without restricting them to an intended location. An unauthenticated attacker can therefore read files anywhere on the operating system that the service can access: a local file inclusion / path traversal issue.

This vulnerability is tracked as CVE-2024-48824. The authoritative record is on the CVE List (CVE-2024-48824), with severity metrics on the National Vulnerability Database.

Technical detail

Specifying the directory and file separately defeats naive filename checks:

GET /download-file.php?Racine=/etc&FileName=passwd HTTP/1.1
Host: <IP>
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.120 Safari/537.36
Connection: keep-alive

The response returns the contents of the referenced file, confirming that the combined path escapes the intended web directory.

Impact

Unauthenticated disclosure of arbitrary readable files on the host running the Monitoring Panel. As with the SlimLane LFI, this typically yields configuration and credential material that supports deeper compromise.

Remediation

Resolve download requests against a fixed base directory and reject any resolved path that escapes it.
Prefer an indirect reference (an ID mapped server-side to a known file) over accepting a directory and filename from the client.
Apply least privilege to the service account.

Common questions

What is CVE-2024-48824?

A local file inclusion / path traversal vulnerability in download-file.php in the Automatic Systems Monitoring Panel. The Racine and FileName parameters combine into a path that can escape the web directory.

Is it the same as CVE-2024-48823?

They are closely related file-read issues but in different components: CVE-2024-48823 is in the SlimLane PassageAutoServer.php, while CVE-2024-48824 is in the Monitoring Panel's download-file.php. Each was assigned its own CVE.

Does it need authentication?

No, an unauthenticated attacker with network access to the endpoint can read files.

What is the remediation?

Constrain downloads to a fixed base directory, reject escaping paths, and ideally use indirect references mapped server-side.

CVE-2024-48824: Local File Inclusion in Automatic Systems Monitoring Panel (download-file.php)