Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

The primary impact of CVE-2024-2224 is the potential for arbitrary code execution. An attacker exploiting this Path Traversal vulnerability can bypass intended access controls and gain elevated privileges within the affected GravityZone instance. This could lead to complete compromise of the control center, allowing the attacker to manage endpoints, modify configurations, and potentially exfiltrate sensitive data. Given GravityZone's role in managing endpoint security, a successful exploitation could have a wide-ranging impact, affecting all endpoints under its control. The ability to execute arbitrary code mirrors the impact of vulnerabilities like CVE-2021-44228 (Log4Shell), where attackers could leverage a seemingly minor flaw to achieve full system control.

Organizations heavily reliant on Bitdefender GravityZone for centralized endpoint management are at significant risk. This includes businesses with on-premises GravityZone deployments, particularly those with older versions (6.36.1) that have not yet been upgraded. Shared hosting environments utilizing GravityZone for managing multiple client endpoints could also be vulnerable, potentially exposing multiple tenants to compromise.

• linux / server:

journalctl -u bitdefender -f | grep -i "path traversal"

• linux / server:

lsof -i :8080 | grep bitdefender

• generic web:

curl -I <gravityzone_url>/updateServer/path/to/sensitive/file

• generic web:

grep -r "path traversal" /opt/bitdefender/gravityzone/controlcenter/

1. 2024-04-09Disclosure

   disclosure

1. Reserviert2024-03-06
2. Veröffentlicht2024-04-09
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-2224 is to upgrade to Bitdefender GravityZone Control Center version 6.36.2 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting network access to the UpdateServer component. Implement strict firewall rules to limit access to the UpdateServer component to only authorized systems. Monitor system logs for suspicious activity, particularly attempts to access files outside of the intended directory. While no specific Sigma or YARA rules are readily available, creating custom rules to detect unusual file access patterns within the UpdateServer directory is recommended. After upgrading, confirm the fix by attempting to access restricted files via the UpdateServer component and verifying that access is denied.