Willkürliches Schreiben von Dateien in der IRIS EVTX Pipeline

The core of this vulnerability lies in the unsafe handling of filenames during EVTX file uploads through the iris-evtx-module pipeline. An attacker can craft a malicious EVTX file with a specially designed filename that, when processed by the module, allows them to write arbitrary files to the server's filesystem. This is not a direct RCE on its own. However, the ability to write files opens the door to Server-Side Template Injection (SSTI). By injecting malicious code into a template engine used by the IRIS web application, an attacker could then execute arbitrary commands on the server, gaining complete control. The blast radius extends to any data accessible by the IRIS web application, including sensitive log data and potentially other system resources.

Organizations utilizing the IRIS EVTX Pipeline Module for log ingestion, particularly those with internet-facing deployments or those using the module to process logs from untrusted sources, are at significant risk. Legacy configurations of IRIS web applications and environments where input validation is weak are especially vulnerable.

• linux / server:

find /opt/iris/ -name "iris-evtx-module*" -mtime +7  # Check for older versions
journalctl -u iris-web -g "EVTX upload" | grep -i "error" # Look for upload errors

• generic web:

curl -I <IRIS_WEB_ENDPOINT>/evtx_upload.php | grep -i "server" # Check server header for potential information leakage

1. 2024-05-23Disclosure

   disclosure

1. Reserviert2024-04-30
2. Veröffentlicht2024-05-23
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-34060 is to immediately upgrade the IRIS EVTX Pipeline Module to version 1.0.0 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. Restrict file upload permissions to the IRIS EVTX Pipeline Module user account to the minimum necessary. Implement strict filename validation on the server-side to prevent the upload of files with potentially malicious characters or paths. Web Application Firewalls (WAFs) configured to detect and block attempts to upload files with unusual or unexpected filenames can also provide a layer of defense. Monitor system logs for unusual file creation or modification activity.