CVE-2024-0643: Cires21 Live Encoder RCE Vulnerability

CVE-2024-0643 Overview

CVE-2024-0643 is an unrestricted file upload vulnerability affecting the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to upload files with dangerous extensions without any restrictions, potentially resulting in full system compromise. The flaw stems from insufficient validation of file types during the upload process, enabling attackers to upload malicious files such as web shells or executable scripts.

Critical Impact

This vulnerability enables unauthenticated remote attackers to upload arbitrary file types, including malicious executables and web shells, leading to complete system compromise with full confidentiality, integrity, and availability impact.

Affected Products

• Cires21 Live Encoder version 5.3
• Cires21 Live Mosaic version 5.3

Discovery Timeline

• 2024-01-17 - CVE-2024-0643 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0643

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected C21 Live Encoder and Live Mosaic application fails to properly validate or restrict file types during the upload process. This design flaw allows attackers to bypass intended security controls and upload files with arbitrary extensions, including executable scripts and binaries.

The vulnerability is exploitable remotely without authentication, requiring no user interaction. An attacker can leverage this flaw to upload malicious payloads such as PHP web shells, reverse shell scripts, or other executable content to the server. Once uploaded, these files can be executed on the target system, granting the attacker complete control over the affected host.

Root Cause

The root cause of this vulnerability lies in the absence of proper file type validation and restriction mechanisms within the upload functionality of the C21 Live Encoder and Live Mosaic application. The application does not implement adequate server-side checks to verify that uploaded files conform to expected file types, nor does it sanitize or reject files with dangerous extensions such as .php, .asp, .jsp, or executable binaries.

Attack Vector

The attack vector for CVE-2024-0643 is network-based, allowing remote exploitation. An attacker can exploit this vulnerability by:

1. Identifying the file upload endpoint in the C21 Live Encoder or Live Mosaic web interface
2. Crafting a malicious file with a dangerous extension (e.g., a PHP web shell)
3. Uploading the malicious file through the vulnerable upload functionality
4. Accessing the uploaded file directly via the web server to trigger execution
5. Achieving remote code execution with the privileges of the web server process

The exploitation requires no privileges or user interaction, making it highly accessible to attackers who can reach the application over the network.

Detection Methods for CVE-2024-0643

Indicators of Compromise

• Presence of unexpected executable files (.php, .asp, .jsp, .exe, .sh) in upload directories
• Web server logs showing requests to newly uploaded files with executable extensions
• Unusual outbound network connections from the web server process
• File system changes indicating new or modified scripts in web-accessible directories

Detection Strategies

• Monitor file upload directories for files with executable or script extensions
• Implement file integrity monitoring on the C21 Live Encoder and Live Mosaic installation directories
• Analyze web server access logs for suspicious POST requests to upload endpoints followed by GET requests to unexpected file paths
• Deploy network traffic analysis to identify potential command-and-control communications originating from the web server

Monitoring Recommendations

• Enable detailed logging for the C21 Live Encoder and Live Mosaic application, particularly for file upload operations
• Configure SIEM alerts for file creation events involving executable extensions in web server directories
• Implement real-time file system monitoring using endpoint detection and response (EDR) solutions
• Regularly audit uploaded files and compare against known-good baselines

How to Mitigate CVE-2024-0643

Immediate Actions Required

• Restrict network access to the C21 Live Encoder and Live Mosaic application to trusted IP addresses only
• Implement web application firewall (WAF) rules to block uploads of dangerous file types
• Disable or restrict access to the file upload functionality until a patch is applied
• Review upload directories for any suspicious or unauthorized files and remove them immediately

Patch Information

Consult the INCIBE Security Notice for official vendor guidance and remediation steps. Contact Cires21 directly for patch availability and upgrade instructions for affected product versions.

Workarounds

• Implement strict file type whitelisting at the web server level to only allow expected file extensions
• Configure the web server to prevent script execution in upload directories using directives such as php_flag engine off for Apache or equivalent settings
• Deploy network segmentation to isolate the vulnerable application from critical systems
• Use a reverse proxy or WAF to inspect and filter file upload requests before they reach the application

# Apache configuration to disable script execution in upload directory
<Directory "/var/www/c21/uploads">
    php_flag engine off
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
    AddType text/plain .php .phtml .php3 .php4 .php5 .phps
</Directory>