Description
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traccar | traccar | < 6.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)
exploit/linux/http/traccar_rce_upload
-
Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
exploit/linux/http/paloalto_expedition_rce
GitHub 1 repository
-
gh-ost00/CVE-2024-24809-Proof-of-concept ★ 5 · Sep 3, 2024
Critical Flaws in Traccar GPS System Expose Users to Remote Attacks
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Traccar - Unrestricted File Upload http/cves/2024/CVE-2024-24809.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.