CVE-2024-0352: Likeshop RCE Vulnerability

CVE-2024-0352 Overview

A critical unrestricted file upload vulnerability has been identified in Likeshop e-commerce platform versions up to 2.5.7.20210311. This vulnerability exists in the FileServer::userFormImage function within the file server/application/api/controller/File.php, which is part of the HTTP POST Request Handler component. The flaw allows attackers to upload arbitrary files without proper validation, potentially leading to remote code execution on affected systems.

Critical Impact

This unrestricted file upload vulnerability can be exploited remotely without authentication, allowing attackers to upload malicious files (such as web shells) and achieve complete system compromise with high impact on confidentiality, integrity, and availability.

Affected Products

• Likeshop versions up to and including 2.5.7.20210311
• Likeshop e-commerce platform installations using the vulnerable File.php controller
• Systems exposing the userFormImage endpoint to untrusted networks

Discovery Timeline

• 2024-01-09 - CVE-2024-0352 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0352

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-known weakness class that occurs when applications fail to properly validate file uploads. The vulnerable FileServer::userFormImage function processes user-submitted files through HTTP POST requests without adequate security controls.

The attack can be initiated remotely over the network with low complexity, requiring no privileges or user interaction. When exploited, attackers can upload arbitrary file types, including executable scripts such as PHP web shells. Once uploaded to a web-accessible directory, these malicious files can be executed by accessing them directly, granting the attacker full control over the web application and potentially the underlying server.

The vulnerability has been publicly disclosed, and exploit details have been made available, significantly increasing the risk of active exploitation in the wild.

Root Cause

The root cause of this vulnerability lies in the insufficient validation within the FileServer::userFormImage function. The file parameter accepts user-controlled input without properly verifying the file type, extension, or content. This allows an attacker to bypass any intended restrictions on file uploads and submit dangerous file types such as .php, .phtml, or other server-side executable scripts.

Proper file upload security should include validation of MIME types, file extensions, file content (magic bytes), and storage of uploaded files outside the web root or with non-executable permissions.

Attack Vector

The attack is executed remotely via HTTP POST requests to the vulnerable endpoint. An attacker crafts a malicious request containing a dangerous file (such as a PHP web shell) in the file parameter. The server processes this request through the FileServer::userFormImage function, which stores the file without proper validation.

The exploitation flow typically involves:

1. Identifying a Likeshop installation running a vulnerable version
2. Crafting an HTTP POST request to the file upload endpoint
3. Uploading a malicious PHP file disguised or submitted as an image
4. Accessing the uploaded file directly to execute arbitrary code on the server

For technical details about the exploitation mechanism, refer to the Zhaoj Blog Post and VulDB Entry #250120.

Detection Methods for CVE-2024-0352

Indicators of Compromise

• Unexpected PHP files or other executable scripts appearing in upload directories (e.g., /uploads/, /images/, or similar paths)
• HTTP POST requests to the FileServer::userFormImage endpoint containing non-image file extensions
• Web shell signatures or suspicious file content in recently uploaded files
• Unusual outbound network connections or command execution from the web server process

Detection Strategies

• Implement web application firewall (WAF) rules to detect file upload requests containing PHP or other executable file extensions
• Monitor file system events for creation of new executable files in web-accessible directories
• Deploy endpoint detection solutions like SentinelOne to identify web shell execution and post-exploitation activities
• Review web server access logs for requests to newly created files in upload directories

Monitoring Recommendations

• Enable file integrity monitoring (FIM) on upload directories to alert on creation of new files
• Configure alerting for HTTP 200 responses to POST requests against vulnerable file upload endpoints
• Monitor process execution chains originating from web server processes (e.g., php-fpm, apache2, nginx)
• Track network connections initiated by web application processes for potential command-and-control activity

How to Mitigate CVE-2024-0352

Immediate Actions Required

• Upgrade Likeshop to a version newer than 2.5.7.20210311 if a patched version is available from the vendor
• Restrict network access to the file upload endpoint using firewall rules or application-level access controls
• Audit existing upload directories for any suspicious or unexpected files and remove them immediately
• Implement application-level file type validation as an interim measure until patching is complete

Patch Information

Organizations running affected versions of Likeshop should check with the vendor for security updates addressing CVE-2024-0352. Consult the VulDB entry for the latest information on available patches and remediation guidance.

Workarounds

• Disable the affected file upload functionality by removing or restricting access to the File.php controller if not required
• Implement server-side file validation that checks MIME types, extensions, and file content (magic bytes)
• Configure the web server to prevent execution of uploaded files by denying script execution in upload directories
• Store uploaded files outside the web root directory or use a separate storage service with restricted access

# Apache configuration to prevent script execution in upload directories
<Directory "/var/www/html/uploads">
    # Disable PHP execution
    php_admin_flag engine off
    
    # Deny access to script files
    <FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
        Require all denied
    </FilesMatch>
</Directory>