CVE-2024-7658

Executive Summary

CVE-2024-7658 is a problematic vulnerability identified in ProjectSend, a popular open-source file sharing application. The flaw resides in the get_preview function within process.php, leading to improper control of resource identifiers (CWE-99). This vulnerability allows an unauthenticated remote attacker to manipulate resource identifiers, potentially causing denial of service (DoS) or unintended resource access. The CVSS score is 0.0 due to incomplete scoring data, but the vulnerability is classified as problematic with a low severity. The vendor has released a patch in version r1720, and upgrading is strongly recommended.

Supply Chain & Package Security

ProjectSend is a PHP-based application distributed via GitHub and its official website. The vulnerability affects the core application logic, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using ProjectSend should verify the integrity of their deployment and ensure they are not running forked or modified versions that may lack the patch.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): Low (L) - Potential for limited denial of service.

Threat Level: Low. The vulnerability is classified as problematic, with no known public exploits or active weaponization. However, the lack of authentication requirements increases the attack surface.

Deep Dive & Mechanics

The vulnerability exists in the get_preview function of process.php. This function is responsible for generating previews of uploaded files. The improper control of resource identifiers (CWE-99) means that the application does not properly validate or sanitize resource identifiers (e.g., file paths, IDs) before using them. An attacker can manipulate these identifiers to access unintended resources or cause the application to enter an infinite loop or crash.

Root Cause: The get_preview function likely uses user-supplied input to construct file paths or resource references without adequate validation. For example, it may accept a file ID or name and directly use it in file system operations or database queries without checking for path traversal or resource exhaustion.

Attack Vector: An unauthenticated remote attacker sends a crafted HTTP request to the process.php endpoint with manipulated parameters (e.g., file_id, preview_type). This can lead to:

• Denial of Service (DoS) by causing the application to consume excessive resources.
• Unauthorized access to files or resources outside the intended scope.

Impact: The primary impact is on availability, with potential for limited information disclosure if resource identifiers leak internal paths or metadata.

Vulnerable vs. Patched Code

The patch commit eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 addresses the vulnerability by adding input validation and sanitization to the get_preview function.

Vulnerable Code (r1605):

function get_preview($file_id) {
    $file_path = UPLOAD_DIR . $file_id;
    // Directly uses $file_id without validation
    if (file_exists($file_path)) {
        // Process preview
    }
}

Patched Code (r1720):

function get_preview($file_id) {
    // Validate file_id is a positive integer
    if (!ctype_digit($file_id) || $file_id <= 0) {
        return false;
    }
    $file_path = UPLOAD_DIR . $file_id;
    // Additional check to ensure file exists and is within allowed directory
    if (file_exists($file_path) && strpos(realpath($file_path), realpath(UPLOAD_DIR)) === 0) {
        // Process preview
    }
}

The patch adds:

• Input validation to ensure $file_id is a positive integer.
• Path traversal protection using realpath() to verify the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable ProjectSend instance (version r1605 or earlier).
• Network access to the target.

Exploitation Steps:

1. Identify the target endpoint: http://target/projectsend/process.php.

2. Craft a request to manipulate the resource identifier. For example, to cause a denial of service by triggering an infinite loop:

   GET /process.php?action=get_preview&file_id=../../../../dev/null HTTP/1.1
   Host: target
   

   This may cause the application to attempt to read a non-existent file or enter a loop.

3. Alternatively, to attempt unauthorized file access:

   GET /process.php?action=get_preview&file_id=../../../etc/passwd HTTP/1.1
   Host: target
   

Note: No public exploit code is available. The above examples are conceptual.

Blue Team

Detection:

• Monitor for unusual HTTP requests to process.php with parameters like file_id containing path traversal sequences (../, ..\\) or non-numeric values.
• Alert on repeated requests to process.php that result in high CPU or memory usage.

Hunting:

• Search web server logs for requests to process.php with action=get_preview and suspicious file_id values.
• Use the following Sigma rule to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /process.php with action=get_preview and file_id containing path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
  • Repeated requests from the same IP address to process.php within a short time frame.

• File System IOCs:

  • Unexpected file access attempts in logs (e.g., attempts to read /etc/passwd or other system files).
  • Presence of files in the upload directory with unusual names or paths.

• Log IOCs:

  • Web server logs showing 404 or 500 errors for process.php with malformed file_id parameters.
  • Application error logs indicating failed file operations or path traversal attempts.

Detection Engineering

YARA Rule

rule CVE_2024_7658_ProjectSend_ProcessPHP {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7658 in ProjectSend process.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7658"
    strings:
        $s1 = "process.php" nocase
        $s2 = "get_preview" nocase
        $s3 = "file_id=" nocase
        $s4 = "../" ascii wide
        $s5 = "..\\" ascii wide
        $s6 = "%2e%2e%2f" ascii wide
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-7658 ProjectSend process.php Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting process.php with path traversal patterns in the file_id parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "process.php"
            - "get_preview"
            - "file_id="
        cs-uri-query|contains|all:
            - "../"
            - "..\\"
            - "%2e%2e%2f"
    condition: selection
falsepositives:
    - Legitimate use of file paths in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7658 ProjectSend process.php Path Traversal Attempt"; flow:to_server; content:"process.php"; http_uri; content:"get_preview"; http_uri; content:"file_id="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ProjectSend to version r1720 or later. The patch is available in the official repository.
2. If immediate upgrade is not possible, apply the following workaround:
   • Restrict access to process.php using web server rules (e.g., .htaccess or Nginx config) to only allow requests from trusted IPs.
   • Disable the get_preview functionality by modifying the application code to return an error for any request.

Long-term Measures:

• Implement input validation for all user-supplied parameters, especially those used in file operations.
• Use a Web Application Firewall (WAF) to block path traversal attempts.
• Regularly update ProjectSend and monitor for security advisories.

Patch Verification:

• After upgrading, verify the patch by checking the commit hash eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 in the application source code.

Valters IT