CVE-2024-37372

What it actually does

The Permission Model skips validation on paths beginning with two backslashes by incorrectly assuming a fixed four-character prefix can always be stripped, allowing certain path traversal sequences to bypass intended access controls.

Why it matters to the business

Attackers with local access may read or write files outside intended directories, increasing risk of data exposure or tampering in environments using the affected permission checks.

How an attack unfolds

An attacker supplies a crafted path starting with \\ that does not match the assumed prefix pattern, causing the permission model to skip restrictions and grant unauthorized file system access.

How to fix it

Update to a version containing corrected path-handling logic in the Permission Model; validate all path inputs without relying on prefix-length assumptions.

How to confirm the fix worked

Review source or binary for updated path normalization that correctly handles leading backslashes; test edge-case paths starting with \\ against permission boundaries.

Typical attack path

1. Identify an application or component enforcing path-based permissions
2. Craft a local file path beginning with two backslashes that evades the four-character prefix assumption
3. Submit the path through the affected API or file operation
4. Bypass permission checks and access restricted resources

How to detect it

Search application and system logs for file operations involving paths that begin with two backslashes; correlate with unexpected access to protected directories.

What your security team should do

• Prioritize patching any components using the affected Permission Model
• Add runtime path canonicalization and input validation around file operations
• Monitor for unusual local file access patterns until mitigations are applied