CVE-2024-7603: Directory Traversal in Logsign Unified SecOps Platform

The impact of CVE-2024-7603 is severe due to the ability to delete arbitrary directories as the root user. A successful exploit could result in the complete destruction of critical system files, configuration data, and security logs. This could render the Logsign Unified SecOps Platform unusable and compromise the integrity of the entire security infrastructure it manages. The requirement for authentication limits the immediate attack surface but does not eliminate the risk, particularly in environments with compromised user accounts or weak password policies. The potential for data exfiltration is indirect, as the primary impact is data destruction, but the loss of logs could hinder forensic investigations following an incident.

1. Reserved2024-08-08
2. Published2024-08-21
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-7603 is to upgrade Logsign Unified SecOps Platform to version 6.4.23 or later. If an immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of authenticated users with administrative privileges. Implement a WAF with rules to block requests containing suspicious path traversal sequences (e.g., '../'). Regularly review and audit user permissions to ensure least privilege access. Monitor system logs for unusual file deletion activity, particularly targeting sensitive directories. After upgrading, confirm the fix by attempting a directory traversal attack via the HTTP API and verifying that access is denied.