Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability

The impact of CVE-2024-7600 is significant due to the ability to delete arbitrary files with root privileges. An attacker who can authenticate to the Logsign Unified SecOps Platform can exploit this vulnerability to delete critical system files, configuration files, or sensitive data stored on the server. This could lead to a complete system outage, data exfiltration, or even remote code execution if the attacker can leverage the file deletion to install malicious code. The requirement for authentication limits the immediate scope, but successful compromise of a user account would grant the attacker this dangerous capability.

Organizations heavily reliant on Logsign Unified SecOps Platform for security monitoring and incident response are particularly at risk. This includes organizations with limited security resources or those using older, unpatched installations of the platform. Shared hosting environments where multiple users share the same Logsign instance are also at increased risk, as a compromised user account could be leveraged to exploit this vulnerability.

• linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/auth.log) for suspicious file deletion attempts, particularly those originating from external sources. Use auditd to track file access and modification events.

auditctl -w / -p wa -k logsign_file_deletion

• generic web: Examine access and error logs for unusual HTTP requests containing path traversal sequences (e.g., ../).

grep -i 'path=../' /var/log/apache2/access.log

1. 2024-08-21Disclosure

   disclosure

1. Reserviert2024-08-08
2. Veröffentlicht2024-08-21
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-7600 is to upgrade Logsign Unified SecOps Platform to version 6.4.23 or later, which contains the fix for this vulnerability. If an immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to the HTTP API service on TCP port 443 to trusted networks only. Review user permissions and ensure that only authorized users have access to sensitive files. Monitor system logs for suspicious file deletion activity. After upgrading, confirm the fix by attempting to access restricted files via the HTTP API and verifying that access is denied.