CVE-2024-39717
Versa Director Dangerous File Type Upload Vulnerability
Description
CVE-2024-39717 is a high-severity unrestricted file upload vulnerability (CVSS 7.2) in Versa Director, a centralized management platform for Versa Networks' SD-WAN solutions. The flaw exists in the "Change Favicon" feature of the Versa Director GUI, allowing authenticated administrators to upload malicious files disguised with a .png extension. Affecting multiple versions including 21.2.2, 21.2.3, 22.1.1, 22.1.2, and 22.1.3, this vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS score of 4.64% (89.1st percentile) indicates a significantly elevated exploitation probability compared to most vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| versa-networks | versa director | 21.2.2; 21.2.3; 22.1.1; 22.1.2; 22.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
Unrestricted File Upload (Dangerous File Type)
This vulnerability involves the ability to upload files with dangerous content types while bypassing file type validation. The Versa Director GUI's "Change Favicon" feature is intended to accept only image files for customizing the platform's user interface. However, insufficient validation of uploaded file content allows a malicious file ending with a .png extension to be uploaded and potentially executed on the server. This class of vulnerability is categorized as an unrestricted or dangerous file type upload, where the application fails to properly verify that the uploaded file matches the expected type based on its content rather than just its extension. In network management platforms like Versa Director, such vulnerabilities are particularly critical because they can provide attackers with a foothold in infrastructure that controls an organization's entire SD-WAN deployment.
Impact Analysis
The CVSS score of 7.2 (High) reflects a significant threat, though somewhat mitigated by the requirement for high-privilege authentication. Confidentiality impact is rated High, as successful exploitation could allow attackers to access sensitive SD-WAN configuration data, network topology information, and credentials stored on the Versa Director management platform. Integrity impact is also High, meaning attackers could modify SD-WAN configurations, inject malicious routing rules, or alter network policies across the entire managed infrastructure. Availability impact is High as well, since compromising the central management platform could disrupt the SD-WAN services for all connected sites.
The business implications are substantial because Versa Director is the central control plane for SD-WAN deployments. Compromising this platform gives an attacker visibility into and control over the organization's entire wide-area network infrastructure. The EPSS score of 4.64% (89.1st percentile) indicates that exploitation is significantly more likely than for the average vulnerability. Its inclusion in the KEV catalog confirms that real-world attacks are occurring. While the ransomware association is listed as unknown, the strategic value of compromising network management infrastructure makes this vulnerability attractive to advanced persistent threat groups and state-sponsored actors seeking persistent network access.
Exploit Maturity
CVE-2024-39717 is confirmed as actively exploited in the wild, as indicated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 13, 2024. The EPSS score of 4.64% (89.1st percentile) indicates that the vulnerability is more likely to be exploited than nearly 90% of all tracked CVEs. Versa Networks published a security bulletin acknowledging the vulnerability and providing remediation guidance. Although exploitation requires Provider-Data-Center-Admin or Provider-Data-Center-System-Admin credentials, the confirmed active exploitation suggests that attackers have obtained these credentials through prior compromise, credential theft, or by targeting default configurations. The strategic value of Versa Director as a network management platform makes it a high-value target for sophisticated threat actors, and the ransomware association remains unknown.
Remediation
-
Apply the vendor-provided patch immediately — Consult the Versa Networks security bulletin for the specific patched firmware version for your deployment and follow the upgrade procedures. Contact Versa Networks support if you need assistance with the upgrade path.
-
Restrict administrative access — Limit access to Versa Director's administrative interface to only authorized personnel from trusted networks. Implement network segmentation to ensure the management plane is not accessible from untrusted network segments or the general internet.
-
Review and rotate administrative credentials — Since exploitation requires Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges, audit all administrative accounts, remove unnecessary privileged accounts, enforce strong password policies, and enable multi-factor authentication for all administrative access.
-
Audit uploaded files and system integrity — Inspect the Versa Director file system for any suspicious files, particularly in directories associated with the favicon feature. Look for files with .png extensions that contain executable content or unexpected file signatures. Review system logs for unauthorized upload activities.
-
Implement network monitoring for anomalous traffic — Deploy monitoring on the Versa Director management network to detect unusual file upload activity, unexpected outbound connections, or other indicators of compromise that could suggest the platform has been exploited.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H provides important context about the attack requirements. Attack Vector (Network) means the vulnerability is exploitable remotely. Attack Complexity (Low) indicates no special conditions beyond having valid credentials. Privileges Required (High) is the key limiting factor — the attacker must possess Provider-Data-Center-Admin or Provider-Data-Center-System-Admin credentials. User Interaction (None) means no victim involvement is needed beyond the attacker's own actions. Scope (Unchanged) keeps the impact within the Versa Director context. All three impact metrics are High.
The vulnerability resides in the "Change Favicon" functionality of the Versa Director GUI, which is designed to allow administrators to customize the platform's user interface by uploading a custom favicon image. The feature accepts file uploads but fails to adequately validate the content type of the uploaded file beyond checking the file extension. An attacker with administrative credentials can upload a malicious file (such as a web shell or backdoor) by appending a .png extension to the filename, causing the application to accept it as a legitimate image file. Once uploaded, the malicious file can potentially be accessed and executed through the web server, granting the attacker persistent code execution on the Versa Director server. This technique of masquerading malicious payloads as image files is a well-known attack pattern, and the lack of content-based file type validation (magic byte checking, MIME type verification) in a critical infrastructure management tool represents a significant security oversight.
Frequently Asked Questions
What is CVE-2024-39717?
CVE-2024-39717 is a high-severity file upload vulnerability in Versa Director, the centralized management platform for Versa Networks' SD-WAN solutions. It allows authenticated administrators to upload malicious files through the "Change Favicon" feature by disguising them with a .png extension, potentially enabling remote code execution on the management server.
Does an attacker need special access to exploit this vulnerability?
Yes, exploitation requires Provider-Data-Center-Admin or Provider-Data-Center-System-Admin credentials on the Versa Director platform. Tenant-level users do not have the necessary privileges. However, the fact that this vulnerability is actively exploited indicates that attackers have found ways to obtain these credentials.
What is the risk of a compromised Versa Director?
Versa Director is the central management platform for an organization's entire SD-WAN infrastructure. A compromised Director gives attackers visibility into network topology, the ability to modify routing configurations, and potential access to all managed network devices. This could enable surveillance, traffic interception, or disruption of wide-area network services.
How can I tell if my Versa Director has been compromised?
Review the file system for suspicious files in directories associated with the favicon feature, particularly files with .png extensions containing non-image content. Check system and access logs for unusual administrative login activity or unexpected file upload operations. Monitor outbound network traffic from the Director for connections to unknown destinations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.