CVE-2024-32491

What it actually does

Authenticated users can manipulate AJAX file upload requests to perform directory traversal, writing attacker-controlled files to arbitrary writable server locations; if the destination is web-accessible this results in remote code execution.

Why it matters to the business

Successful exploitation can lead to complete server takeover, theft of sensitive customer or ticket data, service disruption, and lateral movement into connected systems.

How an attack unfolds

An attacker with valid credentials crafts a manipulated AJAX upload request containing path traversal sequences, uploads a malicious script or web shell to a publicly reachable directory, and then requests the file through the web server to execute arbitrary commands.

How to fix it

Upgrade to the latest patched Znuny or Znuny LTS release. Enforce strict server-side validation that rejects path traversal sequences in upload destinations and restrict the set of directories that the web server process may write to.

How to confirm the fix worked

Confirm the installed version is newer than the vulnerable range, review upload-handling code for traversal sanitization, and attempt controlled path-traversal upload tests in a non-production environment to verify blocking behavior.

Typical attack path

1. Obtain valid user credentials and authenticate to the application
2. Locate the file-upload AJAX endpoint used for attachments or images
3. Inject directory traversal payloads (../ sequences) into the destination path parameter
4. Upload a web shell or executable script to a web-accessible writable directory
5. Access the uploaded file via HTTP to trigger code execution and establish persistence

How to detect it

Search web-server and application logs for file-upload requests containing path-traversal sequences such as ../ or encoded equivalents; inspect recently created or modified files in web-root or other writable directories for unexpected executable content.

• ../
• ..%2f
• ..%5c
• manipulated AJAX upload to file endpoint
• unexpected executable files in web-accessible directories

What your security team should do

• Apply available security updates immediately
• Harden file-upload logic with allow-list validation of target paths
• Add web-application firewall rules to block traversal patterns in upload requests
• Monitor application and web-server logs for anomalous upload activity