GPS Tracking System Vulnerable to Path Traversal and Unrestricted File Upload

CVE-2024-24809

What is CVE-2024-24809?

The Traccar GPS Tracking System is vulnerable to a significant security flaw that allows attackers to perform path traversal and unrestricted file uploads of potentially harmful types. This vulnerability affects all versions of Traccar prior to 6.0, which allows for the default registration of user accounts. By exploiting this vulnerability, an attacker could gain standard user permissions and upload files prefixed with 'device.' into arbitrary folders. This can lead to various attacks, including phishing, cross-site scripting, and the potential for arbitrary command execution on the server. The newly released version 6.0 addresses this security issue with a patch.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2024-24809
Created by Rapid7

Metasploit exploit module for CVE-2024-24809
Created by Rapid7

References