CVE-2024-55457 PoC — MasterSAM Star Gate 安全漏洞

Source

https://github.com/h13nh04ng/CVE-2024-55457-PoC

Associated Vulnerability

Title: MasterSAM Star Gate 安全漏洞 (CVE-2024-55457)
Description:MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially exposing sensitive information.

Readme

# CVE-2024-55457-PoC
MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information.

In the API responsible for downloading logs in the Troubleshooting -> Download Log feature, the application does not perform path validation for the file specified through the file parameter. Additionally, users can call this API without authentication.

GET /adama/adama/downloadService?type={}&file={} HTTP/1.1

![{C74ABE69-71EC-40A5-A361-4FC031820AA1}](https://github.com/user-attachments/assets/970e8f1b-1542-4934-b80e-5473e9acb8fa)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →