# POC - CVE-2024-45241: Path Traversal in CentralSquare's CryWolf

{% tabs %}
{% tab title="Support VeryLazyTech 🎉" %}

* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses.  📚
  {% endtab %}
  {% endtabs %}

## POC - CVE-2024-45241: Path Traversal in CentralSquare's CryWolf

### Vulnerability Overview

CVE Identifier: CVE-2024-45241

Product: CentralSquare CryWolf (False Alarm Management)

Affected Component: GeneralDocs.aspx

Vulnerability Type: Path Traversal

Discovery Date: 2024-08-09

### Description

A path traversal vulnerability has been identified in the GeneralDocs.aspx component of CentralSquare CryWolf, a False Alarm Management system. This vulnerability allows unauthenticated attackers to exploit the rpt parameter to access files outside of the intended web directory. This can lead to the disclosure of sensitive information.

**Read about it** — [CVE-2024-45241](https://nvd.nist.gov/vuln/detail/CVE-2024-45241)

> **Disclaimer**: This Proof of Concept (POC) is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

### Technical Details

#### Path Traversal Vulnerability:

Path traversal vulnerabilities occur when an application allows users to manipulate file paths in a way that allows them to access files and directories outside the intended directory. This is often achieved by using sequences like ../ (dot-dot-slash) to traverse directories.

#### Affected Component:

In this case, the affected component is GeneralDocs.aspx. This ASP.NET page appears to handle document requests or generation based on parameters provided by the user.

#### Parameter in Question:

The rpt parameter is used to specify which document or report should be processed or retrieved. The vulnerability arises because this parameter is not properly sanitized or validated, allowing attackers to manipulate it to traverse directories.

### **Finding Targets**

To find potential targets, use Fofa (similar to Shodan.io):

* **Fofa Dork**: "Powered by CryWolf"

<figure><img src="https://github.com/verylazytech/CVE-2024-45241/raw/main/Fofa%20CVE-2024-45421.png" alt=""><figcaption></figcaption></figure>

### **Enter your browser**

Turn on Burp and start to intercept.

Type in the URL search:

```bash
<TARGET_URL>/GeneralDocs.aspx?rpt=../../../../../<FILE>
```

<figure><img src="https://github.com/verylazytech/CVE-2024-45241/raw/main/GenralDocs.png" alt=""><figcaption></figcaption></figure>

### **Return to burp**

Now you will see the original request of \<TARGET\_URL>/GeneralDocs.aspx?rpt=../../../../../ and click forward:

Click forward until you see this message (GET request to gdoc1.ashx):

<figure><img src="https://github.com/verylazytech/CVE-2024-45241/raw/main/gdoc1.png" alt=""><figcaption></figcaption></figure>

Now right click and click on "Do intercept" --> "Response to this request" then click forward.

<figure><img src="https://github.com/verylazytech/CVE-2024-45241/raw/main/Do%20intercept.png" alt=""><figcaption></figcaption></figure>

You can see the response and the file content!

<figure><img src="https://github.com/verylazytech/CVE-2024-45241/raw/main/Response.png" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
Learn & practice [**For the B**](https://buymeacoffee.com/verylazytech/e/271180)[**ug Bounty**](https://shop.verylazytech.com)

<details>

<summary>Support VeryLazyTech 🎉</summary>

* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses.  📚

</details>
{% endhint %}