CVE-2024-48931: Arbitrary File Access in ZimaOS

The primary impact of CVE-2024-48931 is the potential for unauthorized access to sensitive system files. An attacker who can exploit this vulnerability can read files such as /etc/shadow, which contains password hashes for all user accounts on the system. Successful exploitation could lead to privilege escalation, allowing the attacker to gain root access and completely compromise the ZimaOS instance. The ability to read configuration files and other sensitive data also presents a significant risk of data exfiltration and further system compromise. This vulnerability shares similarities with other file access vulnerabilities where improper input validation allows attackers to bypass security controls.

1. Reserved2024-10-09
2. Published2024-10-24
3. Modified2024-10-25
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-48931 is to upgrade ZimaOS to version 1.2.5 or later, which includes the necessary fix. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /v3/file endpoint with suspicious files parameters. Specifically, look for parameters containing absolute paths or attempts to access system directories like /etc. Additionally, restrict access to the ZimaOS API to trusted networks and users. After upgrading, verify the fix by attempting to access a sensitive file (e.g., /etc/shadow) through the /v3/file endpoint; the request should be rejected.