CVE-2024-58387 in Haiyue HCM Cloud
Summary
by MITRE • 10/01/2026
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The Inspur Haiyue Human Capital Management Cloud platform suffers from a critical arbitrary file read vulnerability located within its web application interface, specifically targeting the /api/model_report/file/download endpoint. This flaw stems from insufficient input validation and sanitization of user-supplied parameters, namely index and ext. When an unauthenticated remote attacker interacts with this API endpoint, they can manipulate these parameters to bypass intended access controls and traverse the underlying file system directory structure. The vulnerability allows for the disclosure of sensitive information stored on the server hosting the application, as the software fails to restrict file paths to a designated safe directory or properly escape special characters that facilitate path traversal sequences such as dot-dot-slash (../).
From a technical perspective, this issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The root cause lies in the application logic which constructs file paths using unsanitized user input without adequate boundary checks. By supplying crafted values for the index and ext parameters, an attacker can inject directory traversal sequences that escape the intended context. This allows the server to locate and serve files from arbitrary locations on the disk rather than restricting access to specific report or model data directories. The exploitation does not require authentication, which significantly lowers the barrier to entry for attackers seeking to exploit this weakness remotely over standard HTTP/HTTPS protocols.
The operational impact of this vulnerability is severe, as it enables unauthenticated remote code disclosure that can lead to further system compromise. Attackers have been observed exploiting this flaw in the wild since November 4, 2024, according to monitoring data from the Shadowserver Foundation. Successful exploitation allows adversaries to read sensitive files such as /etc/passwd and /etc/shadow on Linux-based systems, which may contain user account information and hashed passwords. Additionally, attackers can access application database configuration files, source code repositories, environment variables containing API keys or credentials, and other system configuration files that are not intended for public exposure. This initial foothold often serves as a precursor to more advanced attacks, including credential stuffing, privilege escalation, or full server takeover if combined with other vulnerabilities like remote command execution.
In terms of threat intelligence mapping, this vulnerability aligns with the MITRE ATT&CK technique T1083: File and Directory Discovery, which describes how adversaries search for files and directories containing sensitive information to aid in subsequent phases of an intrusion. The lack of authentication requirements places it within the context of unauthenticated access attacks often seen in web application exploitation campaigns targeting enterprise software solutions. Organizations relying on Inspur Haiyue HCM Cloud must treat this as a high-severity issue requiring immediate attention due to its remote exploitability and potential for significant data breach consequences.
Mitigation strategies should prioritize applying vendor-provided patches or updates that address the input validation flaws in the /api/model_report/file/download endpoint. If patching is not immediately available, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block requests containing directory traversal patterns like ../ within URL parameters. Additionally, implementing strict file access policies on the server side, ensuring that application processes run with minimal privileges and are confined to specific directories via chroot or containerization, can limit the blast radius of such an exploit. Regular security assessments and penetration testing focused on API endpoints are recommended to identify similar input validation weaknesses across other parts of the platform before they are exploited by malicious actors in the wild.