CVE-2024-24398

An attacker sends a crafted payload to the fileName parameter of the Save function, containing path traversal sequences (e.g., '../'). The application does not properly validate the file path provided by the user, allowing the file to be written to any location accessible to the server process. By placing a malicious file (e.g., an executable script) outside the intended directory, the attacker can trigger arbitrary code execution.

An attacker can gain full control over the server by executing arbitrary code with the privileges of the application process. Data confidentiality loss, file modification or deletion, and complete service unavailability are possible.

Stimulsoft Dashboard.JS should be updated to version 2024.1.2 or newer. It is also recommended to restrict network access to the application panel only to trusted IP addresses and to monitor file write attempts outside designated directories.

Stimulsoft Dashboard.JS in versions prior to 2024.1.2