CVE-2024-45398

Executive Summary

CVE-2024-45398 is a critical vulnerability in the Contao Open Source CMS that allows authenticated back-end users with file manager access to upload malicious files and execute them on the server. This is a classic unrestricted file upload vulnerability (CWE-434) that can lead to full remote code execution (RCE). The vulnerability affects all Contao versions prior to 4.13.49, 5.3.15, and 5.4.3. The CVSS score is 8.3 (High), and while the EPSS score is currently 0.0%, the potential impact is severe due to the ability to execute arbitrary code on the web server.

Supply Chain & Package Security

Contao is a PHP-based CMS distributed via Composer. The vulnerability exists in the core file manager component. Users should verify their composer.json and composer.lock files to ensure they are not pinned to a vulnerable version. The patch is available via the official Contao update channels.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a back-end user account with file manager access.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While the EPSS score is low, the vulnerability is trivial to exploit once authenticated, and the impact is complete server compromise.

Deep Dive & Mechanics

The vulnerability resides in Contao's file manager component, which allows authenticated back-end users to upload files. The application fails to properly validate the file type or restrict execution permissions on uploaded files. An attacker can upload a PHP web shell (e.g., .php, .phtml, .php5) or other executable scripts (e.g., .shtml, .cgi) to the file upload directory. If the web server is configured to execute PHP files in that directory, the attacker can then access the uploaded file via a web request, triggering code execution.

The root cause is a missing or insufficient file type validation and the lack of server-side configuration to prevent execution in the upload directory. The patch likely adds file extension whitelisting, MIME type validation, and/or moves uploaded files to a non-executable directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a vulnerable version, the file manager might simply move the uploaded file
// without checking its extension or content type.
$uploadedFile = $_FILES['file'];
$destination = 'files/' . $uploadedFile['name'];
move_uploaded_file($uploadedFile['tmp_name'], $destination);

Patched Code (Conceptual):

// In the patched version, the application validates the file extension
// and may rename the file or move it to a non-executable directory.
$allowedExtensions = ['jpg', 'png', 'gif', 'pdf', 'docx'];
$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array(strtolower($extension), $allowedExtensions)) {
    throw new \Exception('File type not allowed.');
}
// Additionally, the server should be configured to deny execution in the upload directory.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: A valid back-end user account with file manager access.
2. Craft a Web Shell: Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Upload the Shell: Log in to the Contao back end, navigate to the file manager, and upload shell.php.
4. Execute Commands: Access the uploaded shell via a web request:

   https://target.com/files/shell.php?cmd=id
   

5. Post-Exploitation: Use the shell to escalate privileges, pivot, or exfiltrate data.

Blue Team (Detection & Response)

1. Monitor File Uploads: Alert on any upload of files with executable extensions (.php, .phtml, .php5, .shtml, .cgi, .py, .pl) to the file manager.
2. Web Server Logs: Look for requests to /files/*.php or similar patterns from authenticated users.
3. File Integrity Monitoring: Monitor the files/ directory for new files with unexpected extensions.
4. Network Detection: Detect outbound connections from the web server to unknown IPs (C2 traffic).
5. Harden Configuration: Immediately configure the web server to deny execution in the upload directory (e.g., using .htaccess or Nginx config).

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected .php, .phtml, .php5, .shtml, .cgi files in the files/ directory.
• Network Traffic: HTTP requests to /files/*.php?cmd=... or similar patterns.
• Log Entries: POST requests to the file manager upload endpoint with unusual file extensions.
• Process Anomalies: Web server processes spawning child processes (e.g., php-cgi, bash).

Detection Engineering

YARA Rule

rule CVE_2024_45398_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via Contao file manager"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45398"
    strings:
        $php_tag = "<?php"
        $system_call = /system\(|exec\(|shell_exec\(|passthru\(/
        $cmd_param = /\$_GET\[.cmd.\]|\$_POST\[.cmd.\]/
    condition:
        $php_tag and ($system_call or $cmd_param)
}

Sigma Rule

title: Contao File Manager Malicious Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of executable files via Contao file manager
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/contao/file-manager*'
        cs-uri-query|contains: 'upload'
    file_extension:
        cs-uri-query|endswith:
            - '.php'
            - '.phtml'
            - '.php5'
            - '.shtml'
            - '.cgi'
    condition: selection and file_extension
falsepositives:
    - Legitimate PHP file uploads if allowed by policy
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45398 Contao File Manager Malicious Upload"; flow:to_server,established; content:"POST"; http_method; content:"/contao/file-manager"; http_uri; content:".php"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Contao 4.13.49, 5.3.15, or 5.4.3.
2. Workaround: If unable to patch, configure the web server to deny execution of PHP and other scripts in the file upload directory:
   • Apache (.htaccess):

     <FilesMatch "\.(php|phtml|php5|shtml|cgi)$">
         Deny from all
     </FilesMatch>
     

   • Nginx:

     location /files/ {
         location ~ \.php$ {
             deny all;
         }
     }
     

3. Access Control: Review and restrict back-end user permissions. Only grant file manager access to trusted users.
4. File Validation: Implement additional file type validation using MIME type and content inspection.
5. Monitoring: Enable detailed logging for file uploads and monitor for suspicious activity.

Valters IT