CVE-2024-39717

What it actually does

This is an improper file validation issue in the Versa Director GUI customization feature. A user with high-level provider administrative privileges can abuse the “Change Favicon” function to upload a file that ends in .png but is not a legitimate image. If the uploaded content is placed in a web-accessible or executable application context, it may be used as a malicious server-side payload, enabling compromise of confidentiality, integrity, and availability of the Director system. The flaw is especially dangerous where Versa Director management access is exposed beyond trusted administrative networks or where recommended firewall controls were not implemented.

Why it matters to the business

Compromise of Versa Director can affect the management plane for SD-WAN and network services. An attacker may be able to steal credentials or configuration data, alter network policy, disrupt managed connectivity, or use the Director host as a pivot point into downstream infrastructure. This vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2024-09-13, so delayed remediation represents elevated regulatory and operational risk even though the EPSS score is not high. Organizations using Debian-packaged affected components should also note the provided fixed package versions for Debian 12 and Debian 13 where applicable.

How an attack unfolds

An attacker first obtains access to a highly privileged Versa Director account, such as Provider-Data-Center-Admin or Provider-Data-Center-System-Admin, or reaches an exposed/misconfigured management path that allows abuse of the upload workflow. The attacker then submits a crafted upload through the favicon customization function, naming the payload with a .png extension so it passes extension-based checks. Because the application does not sufficiently validate that the file is a safe image, malicious content can be written to the Director system. The attacker then attempts to trigger or interact with the uploaded file, gain persistence, execute commands, collect configuration and credentials, and move laterally through the managed network environment. Public reporting and KEV status indicate real-world exploitation activity, so investigation should not assume this is only a theoretical authenticated-admin issue.

How to fix it

Apply the vendor-provided Versa Director fix or upgrade guidance for this vulnerability and confirm the Director is on a non-affected release. If Debian-packaged affected components are in scope, update Debian 12 systems to the package fixed in 6.1.76-1 and Debian 13 systems to the package fixed in 6.6.15-1, as listed in the provided fixed-version data. Restrict Versa Director management access to trusted administrative networks only, enforce the firewall guidance published by the vendor, and block direct internet access to the management GUI. Remove any suspicious uploaded customization files, especially favicon-related .png files that are not valid images. Enforce MFA and strong access controls for provider-level administrative accounts, rotate credentials after suspected exposure, and ensure uploaded files are validated by content type and magic bytes, stored outside executable paths, and served with non-executable permissions.

How to confirm the fix worked

Confirm the installed Versa Director version is covered by the vendor fix and that any applicable Debian packages are at or above 6.1.76-1 for Debian 12 or 6.6.15-1 for Debian 13 where those packages apply. Verify the management interface is reachable only from approved administrative networks. In a controlled non-production test, confirm that the favicon upload function rejects non-image content renamed with a .png extension or stores it in a non-executable location. Inspect existing uploaded favicon/customization files with tools such as file, strings, and hash comparison to confirm they are valid images and do not contain script, Java, JSP, class, ELF, ZIP/JAR, or shell content. Review web server and application server configuration to confirm upload directories cannot execute server-side code.

Typical attack path

1. Identify an internet-reachable or poorly restricted Versa Director management interface.
2. Obtain or abuse high-privilege Director access, or exploit a firewall/misconfiguration path that exposes the vulnerable workflow.
3. Access the GUI customization capability for changing the favicon.
4. Upload a malicious payload with a .png file extension to masquerade as an image.
5. Locate or invoke the uploaded content from the web/application context.
6. Establish command execution, persistence, or web-shell-like access if the environment allows execution of the uploaded payload.
7. Collect Director configuration, credentials, logs, and network management data.
8. Modify network policy or pivot from the Director host into other infrastructure.

How to detect it

Review Versa Director application logs, GUI audit logs, web access logs, reverse proxy logs, authentication logs, firewall/VPN logs, and EDR telemetry from the Director host. Look for successful or failed provider-level administrative logins from unusual source IPs, followed by favicon or UI customization upload activity. Search for multipart upload requests containing .png filenames, especially around the “Change Favicon” workflow, and correlate them with subsequent HTTP requests to uploaded content. On the host, inspect favicon/customization upload directories for .png files whose file signature is not PNG, whose contents contain script/JSP/Java/class/JAR/ELF markers, or whose modification time aligns with suspicious logins. Investigate any web server, Tomcat, Java, or Director application process spawning operating-system commands such as sh, bash, curl, wget, python, perl, nc, or openssl. Because active exploitation has been reported, also review historical logs prior to patching and look for persistence mechanisms, newly created accounts, modified network configuration, unexpected scheduled jobs, and outbound connections from the Director host to unfamiliar infrastructure.

• Change Favicon
• Provider-Data-Center-Admin
• Provider-Data-Center-System-Admin
• filename="favicon.png"
• multipart/form-data
• Content-Type: image/png
• VersaMem
• .png
• /var/versa/
• /opt/versa/
• /opt/versa/vnms/
• /var/versa/vnms/
• favicon.png
• favicon.ico
• java.lang.Runtime
• ProcessBuilder
• /bin/sh
• /bin/bash
• curl
• wget
• nc
• python
• perl

What your security team should do

• Treat this as urgent because it is in CISA KEV and has confirmed exploitation in the wild; remediate before normal risk-scoring queues.
• Immediately restrict Versa Director GUI access to trusted administrative IP ranges or VPN-only management networks.
• Upgrade Versa Director according to vendor guidance and apply any relevant Debian fixed packages listed for the affected platform.
• Audit all Provider-Data-Center-Admin and Provider-Data-Center-System-Admin accounts for unexpected logins, new accounts, role changes, and credential reuse.
• Search for recently uploaded favicon or UI customization files and validate that .png files are genuine images.
• Hunt for web/application server child processes such as shell, curl, wget, python, perl, or other utilities spawned from the Director service context.
• Rotate high-privilege Director credentials and API keys if suspicious upload or login activity is found.
• Preserve application logs, web access logs, authentication logs, and suspicious uploaded files before cleanup for forensic analysis.