CVE-2024-22724

Executive Summary

CVE-2024-22724 is a critical security vulnerability discovered in osCommerce v4, an open-source e-commerce platform. The flaw resides in the administrator profile photo upload feature, allowing a local attacker with administrative access to bypass file upload restrictions. This bypass enables the upload of arbitrary, potentially malicious files (e.g., PHP web shells), leading to remote code execution (RCE) on the underlying server. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the administrative privileges required, the attack surface is limited to authenticated users, but the impact is severe, potentially leading to full server compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue within the osCommerce v4 application codebase. No supply chain component is involved.

CVSS Breakdown & Threat Level

While a CVSS score was not provided, a reasonable assessment based on the description is as follows:

• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the admin panel.
• Attack Complexity (AC): Low (AC:L) – The attack is straightforward, requiring only a crafted file upload.
• Privileges Required (PR): High (PR:H) – Administrative credentials are needed.
• User Interaction (UI): None (UI:N) – No user interaction beyond the attacker's actions.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (I:H) – The attacker can modify files and system state.
• Availability (A): High (A:H) – The attacker can disrupt services.

Estimated CVSS v3.1 Score: 7.2 (High)

Threat Level: High. The vulnerability allows for complete server compromise, though it requires administrative access.

Deep Dive & Mechanics

The vulnerability is a classic case of Unrestricted File Upload (CWE-434). The administrator profile photo upload feature in osCommerce v4 fails to properly validate the file type, content, or extension of uploaded files. While the application may intend to accept only image files (e.g., JPEG, PNG), the server-side validation is insufficient or absent.

Attack Flow:

1. An attacker gains administrative credentials to the osCommerce v4 admin panel (e.g., via phishing, credential stuffing, or other means).
2. The attacker navigates to the profile photo upload feature.
3. Instead of an image, the attacker uploads a malicious file, such as a PHP web shell (e.g., shell.php or shell.php.jpg).
4. The server accepts the file and stores it in a web-accessible directory (e.g., /images/ or /uploads/).
5. The attacker accesses the uploaded file via a web browser, triggering the execution of the malicious code.
6. The attacker now has remote code execution on the server, allowing them to execute system commands, exfiltrate data, or pivot to other systems.

Root Cause: The lack of proper file type validation (MIME type, magic bytes, extension whitelist) and the absence of a secure file storage mechanism (e.g., storing files outside the web root with a script to serve them).

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison of vulnerable and secure code.

Vulnerable Code (PHP):

<?php
// Vulnerable: No validation
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["photo"]["name"]);
move_uploaded_file($_FILES["photo"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (PHP):

<?php
// Patched: Validate file type and extension
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$file_type = mime_content_type($_FILES["photo"]["tmp_name"]);
$file_extension = strtolower(pathinfo($_FILES["photo"]["name"], PATHINFO_EXTENSION));

if (in_array($file_type, $allowed_types) && in_array($file_extension, $allowed_extensions)) {
    $target_file = $target_dir . uniqid() . '.' . $file_extension;
    move_uploaded_file($_FILES["photo"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
} else {
    echo "Invalid file type.";
}
?>

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to osCommerce v4 admin panel.
• A PHP web shell (e.g., shell.php).

Steps:

1. Log in to the osCommerce v4 admin panel.
2. Navigate to the profile photo upload feature.
3. Upload the PHP web shell (e.g., shell.php).
4. Access the uploaded file via the web server (e.g., http://target.com/uploads/shell.php).
5. Execute commands via the web shell (e.g., ?cmd=id).

Example Web Shell (shell.php):

<?php
system($_GET['cmd']);
?>

Blue Team (Defense & Detection)

Defensive Measures:

• Implement strict file upload validation (MIME type, magic bytes, extension whitelist).
• Store uploaded files outside the web root and serve them via a script.
• Use a Web Application Firewall (WAF) to block malicious file uploads.
• Monitor for unusual file uploads in admin logs.

Detection:

• Monitor for file uploads with non-image extensions (e.g., .php, .asp).
• Alert on file uploads to directories that should only contain images.
• Use file integrity monitoring to detect new files in upload directories.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example hashes for a common web shell)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file)
  • a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 (example shell)
• File Paths:
  • /uploads/shell.php
  • /images/shell.php
  • /admin/uploads/shell.php
• Network Indicators:
  • HTTP requests to /uploads/*.php or /images/*.php with cmd parameters.
  • Outbound connections from the web server to unknown IPs (C2 traffic).
• Log Entries:
  • POST /admin/upload_photo.php with non-image file type.
  • GET /uploads/shell.php with cmd parameter.

Detection Engineering

YARA Rule

rule Detect_Web_Shell_Upload {
    meta:
        description = "Detects PHP web shells uploaded to osCommerce v4"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22724"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: Suspicious File Upload to osCommerce Admin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads with non-image extensions to osCommerce admin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/upload_photo.php'
        cs-uri-query: '*'
    condition: selection
    filter:
        cs-uri-query: '*.jpg' or '*.png' or '*.gif'
    condition: selection and not filter
falsepositives:
    - Legitimate admin uploading images
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-22724 - osCommerce Admin File Upload Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/admin/upload_photo.php"; http_uri; content:"Content-Type|3a 20|multipart/form-data"; http_header; pcre:"/\.(php|phtml|php3|php4|php5|php7|shtml|asa|cer|asa|jsp|asp|aspx|exe|dll|com|bat|cmd|sh|pl|cgi|py)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the profile photo upload feature in the admin panel until a patch is available.
2. Restrict file uploads to only allow image files (JPEG, PNG, GIF) using server-side validation.
3. Implement a Web Application Firewall (WAF) rule to block file uploads with executable extensions.

Long-term Fixes:

• Apply vendor patch when available.
• Upgrade to a patched version of osCommerce.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block access to uploaded files with executable extensions.
• Store uploaded files in a database instead of the filesystem, or use a secure file storage service.

Valters IT