CVE-2024-0783: Online Admission System RCE Vulnerability

CVE-2024-0783 Overview

A critical unrestricted file upload vulnerability has been discovered in Project Worlds Online Admission System version 1.0. This security flaw exists in the documents.php file, allowing attackers to upload arbitrary files without proper validation or restrictions. The vulnerability enables remote attackers to potentially achieve Remote Code Execution (RCE) by uploading malicious files such as PHP web shells to the target server.

Critical Impact

This unrestricted file upload vulnerability allows unauthenticated remote attackers to upload malicious files, potentially leading to complete server compromise through Remote Code Execution (RCE).

Affected Products

• Project Worlds Online Admission System 1.0
• Applications using documents.php file upload functionality

Discovery Timeline

• 2024-01-22 - CVE-2024-0783 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0783

Vulnerability Analysis

This vulnerability stems from a lack of proper input validation and file type verification in the documents.php file of the Online Admission System. The application fails to implement adequate security controls when processing file uploads, allowing attackers to bypass expected restrictions and upload arbitrary file types.

The unrestricted upload vulnerability (CWE-434) occurs when the application does not properly validate the content type, file extension, or file contents before storing uploaded files in accessible directories. Without these critical checks, an attacker can upload executable scripts such as PHP web shells that, when accessed via a web browser, execute arbitrary commands on the underlying server.

Root Cause

The root cause of this vulnerability is the absence of proper file upload validation mechanisms in the documents.php component. The application lacks:

• File type verification based on MIME type and magic bytes
• Allowlist-based file extension filtering
• Content validation to prevent executable code uploads
• Proper storage of uploaded files outside the web root
• Randomization of uploaded filenames to prevent direct access

Attack Vector

The attack can be initiated remotely over the network without requiring authentication or user interaction. An attacker exploits this vulnerability by:

1. Identifying the vulnerable documents.php endpoint in the Online Admission System
2. Crafting a malicious file (typically a PHP web shell) designed to execute arbitrary commands
3. Uploading the malicious file through the unprotected upload mechanism
4. Accessing the uploaded file via direct URL to trigger code execution
5. Executing arbitrary commands with the privileges of the web server process

The vulnerability has been publicly disclosed, and a proof-of-concept exploit is available in the GitHub RCE PoC Repository, which demonstrates the complete exploitation workflow including the PoC script.

Detection Methods for CVE-2024-0783

Indicators of Compromise

• Unexpected PHP files or other executable scripts appearing in upload directories
• Web server logs showing POST requests to documents.php followed by GET requests to newly created files in upload folders
• Suspicious outbound network connections from the web server process
• Unusual process spawning from the web server (e.g., cmd.exe, bash, or other shells)

Detection Strategies

• Monitor file system events for creation of new executable files (.php, .phtml, .phar) in upload directories
• Implement web application firewall (WAF) rules to detect file upload attacks and web shell signatures
• Analyze HTTP logs for patterns consistent with file upload exploitation attempts targeting documents.php
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities

Monitoring Recommendations

• Enable detailed logging for all file upload operations including file names, sizes, and source IPs
• Configure intrusion detection systems (IDS) to alert on known web shell signatures and suspicious file uploads
• Implement real-time monitoring of upload directories for unauthorized file modifications
• Review web server access logs regularly for unusual access patterns to uploaded files

How to Mitigate CVE-2024-0783

Immediate Actions Required

• Immediately disable or restrict access to the documents.php file upload functionality until a patch is applied
• Audit existing upload directories for any suspicious or unauthorized files and remove them
• Implement network-level access controls to limit exposure of the Online Admission System
• Consider taking the application offline if it handles sensitive admission data until properly secured

Patch Information

No official vendor patch has been identified for this vulnerability at the time of publication. Organizations using Project Worlds Online Admission System 1.0 should contact the vendor for security updates or consider implementing the workarounds below. Additional technical details are available through VulDB #251699.

Workarounds

• Implement server-side file validation using an allowlist of permitted file extensions (e.g., .pdf, .jpg, .png)
• Add MIME type verification and magic byte checking to validate uploaded file contents
• Store uploaded files outside the web root directory to prevent direct execution
• Rename uploaded files using random identifiers and serve them through a controlled download script
• Apply the principle of least privilege to the web server process to limit impact of potential compromise

# Example Apache configuration to prevent execution of uploaded files
<Directory /var/www/html/uploads>
    # Disable PHP execution in upload directory
    php_admin_flag engine off
    
    # Disable script execution
    Options -ExecCGI
    
    # Only allow specific file types
    <FilesMatch "\.(?!(jpg|jpeg|png|gif|pdf)$)[^.]+$">
        Require all denied
    </FilesMatch>
</Directory>