CVE-2024-0300: Byzoro Smart S150 Firmware RCE Vulnerability

CVE-2024-0300 Overview

A critical unrestricted file upload vulnerability has been identified in the Byzoro Smart S150 Management Platform affecting versions up to 20240101. This vulnerability exists in the HTTP POST Request Handler component, specifically within the file /useratte/userattestation.php. Through manipulation of the web_img argument, attackers can upload arbitrary files without restriction, potentially leading to remote code execution on affected systems.

Critical Impact

This unrestricted file upload vulnerability allows remote attackers to upload malicious files without authentication, potentially enabling complete system compromise through arbitrary code execution.

Affected Products

• Byzoro Smart S150 Firmware (versions up to 20240101)
• Byzoro Smart S150 Hardware Device

Discovery Timeline

• 2024-01-08 - CVE-2024-0300 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0300

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-known class of security flaws that occurs when web applications fail to properly validate uploaded files. In the Byzoro Smart S150 Management Platform, the /useratte/userattestation.php endpoint accepts file uploads through HTTP POST requests without implementing adequate validation of the file type, content, or extension.

The exploitation path is straightforward: an attacker can craft a malicious HTTP POST request targeting the vulnerable endpoint, manipulating the web_img parameter to upload executable files such as PHP web shells. Once uploaded, these files can be accessed via the web server to execute arbitrary commands with the privileges of the web application process.

The vendor was contacted early about this disclosure but did not respond, indicating organizations using this device may have limited remediation options through official channels.

Root Cause

The root cause of this vulnerability is improper input validation in the file upload functionality. The application fails to implement critical security controls including:

• Validation of file extensions against an allowlist of permitted types
• Verification of file content and MIME type
• Sanitization of file names to prevent directory traversal
• Storage of uploaded files outside the web root or with non-executable permissions

Attack Vector

This vulnerability is exploitable remotely over the network without requiring authentication or user interaction. An attacker can target the vulnerable endpoint directly by sending specially crafted HTTP POST requests containing malicious file content in the web_img parameter. The attack requires no special privileges and can be automated for mass exploitation.

The exploit has been publicly disclosed, as documented in the GitHub PoC Repository, increasing the risk of widespread exploitation. Attackers could leverage this vulnerability to:

1. Upload PHP web shells for persistent remote access
2. Deploy cryptocurrency miners or botnet agents
3. Pivot to internal network resources
4. Exfiltrate sensitive configuration data

Detection Methods for CVE-2024-0300

Indicators of Compromise

• Unusual HTTP POST requests targeting /useratte/userattestation.php with suspicious file content
• New or unexpected files appearing in web-accessible directories on the device
• Outbound network connections from the device to unknown external IP addresses
• Web shell artifacts or suspicious PHP files in upload directories

Detection Strategies

• Monitor HTTP traffic for POST requests to /useratte/userattestation.php containing executable file types or suspicious content patterns
• Implement file integrity monitoring on the Byzoro Smart S150 device to detect unauthorized file creation
• Deploy network intrusion detection rules to identify web shell communication patterns
• Review web server access logs for requests to newly created files in upload directories

Monitoring Recommendations

• Enable comprehensive logging on the Byzoro Smart S150 Management Platform and centralize logs for analysis
• Configure alerting for any file upload activity to the vulnerable endpoint
• Monitor for command execution patterns typical of web shell activity, such as base64-encoded commands or common reconnaissance commands
• Implement network segmentation monitoring to detect lateral movement attempts originating from the device

How to Mitigate CVE-2024-0300

Immediate Actions Required

• Isolate affected Byzoro Smart S150 devices from untrusted networks immediately
• Implement network-level access controls to restrict access to the management interface to trusted administrative IP addresses only
• Deploy a web application firewall (WAF) rule to block POST requests to /useratte/userattestation.php
• Conduct forensic analysis of affected devices to identify potential compromise

Patch Information

No official patch information is available from the vendor. According to the CVE disclosure, the vendor (Byzoro) was contacted early about this vulnerability but did not respond. Organizations should contact Byzoro directly to inquire about firmware updates or consider replacing affected devices with alternatives from vendors with responsive security practices.

For additional technical details, refer to VulDB #249866 and the associated VulDB CTI Insight.

Workarounds

• Place the Byzoro Smart S150 behind a firewall and restrict management interface access to internal networks only
• Implement HTTP authentication at the reverse proxy or load balancer level in front of the device
• Disable the vulnerable endpoint if the functionality is not required for operations
• Consider virtual patching through WAF rules that validate file uploads to the affected endpoint

# Example iptables rule to restrict management interface access
# Allow only trusted management subnet to access device
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP