Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability

Successful exploitation of CVE-2024-12830 allows an attacker to execute arbitrary code on the affected Arista NG Firewall system. Given the lack of authentication required, this vulnerability is particularly concerning. An attacker could potentially gain full control of the firewall, leading to data breaches, system compromise, and disruption of network services. The code executes in the context of the www-data user, which may have elevated privileges depending on the firewall's configuration. This vulnerability shares similarities with other directory traversal vulnerabilities where attackers leverage flawed path handling to access or modify sensitive files.

Organizations utilizing Arista NG Firewall in environments with exposed management interfaces are at significant risk. Specifically, deployments with default configurations or those lacking robust network segmentation are particularly vulnerable. Shared hosting environments where multiple tenants share the same firewall instance also face increased risk.

• linux / server: Monitor firewall logs for requests to the /custom_handler endpoint with unusual or potentially malicious file paths. Use journalctl to filter for relevant events.

journalctl -u arista-ngfw -f | grep 'custom_handler'

• generic web: Use curl to test the /custom_handler endpoint with various path traversal payloads (e.g., ../etc/passwd).

curl 'http://<firewall_ip>/custom_handler?file=../../../../etc/passwd'

• generic web: Check access logs for requests containing suspicious characters or patterns indicative of directory traversal attempts.

1. 2024-12-20Disclosure

   disclosure

1. Reserviert2024-12-19
2. Veröffentlicht2024-12-20
3. EPSS aktualisiert2026-04-02

While a patch is pending, several mitigation steps can be taken to reduce the risk. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious path traversal sequences (e.g., '../'). Restrict access to the custom_handler endpoint using network segmentation and access control lists (ACLs). Regularly review and harden the firewall's configuration to minimize the privileges of the www-data user. Monitor system logs for unusual activity or attempts to access restricted files. After a patch is released, upgrade to the fixed version and verify the fix by attempting to trigger the vulnerability with a known malicious payload; the request should be blocked by the firewall.