ZimaOS Vulnerable to Directory Traversal Attack

CVE-2024-49359

What is CVE-2024-49359?

The ZimaOS, stemming from CasaOS, is designed for Zima devices and x86-64 systems utilizing UEFI. A notable vulnerability exists in the API endpoint http://<Zima_Server_IP:PORT>/v2_1/file, which is susceptible to directory traversal attacks. This issue permits authenticated users to navigate through any server directory by altering the path parameter. Attackers can exploit this flaw to access sensitive system directories like /etc, potentially revealing critical configuration files. This exposure elevates the risk of subsequent attacks as sensitive information may be compromised. As of now, no patched versions are available for this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References