CVE-2024-10201: Wellchoose Admin System RCE Vulnerability

CVE-2024-10201 Overview

CVE-2024-10201 is an unrestricted file upload vulnerability in the Wellchoose Administrative Management System. The application fails to properly validate the type of files submitted through its upload functionality. Authenticated attackers with regular user privileges can upload webshells to the server. Once uploaded, these webshells execute in the context of the web application, granting remote code execution on the host. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated remote attackers can upload and execute webshells, achieving full compromise of confidentiality, integrity, and availability on affected servers.

Affected Products

Wellchoose Administrative Management System (all versions listed under CPE cpe:2.3:a:wellchoose:administrative_management_system:-:*:*:*:*:*:*:*)
Deployments accepting file uploads from authenticated low-privilege users
Web-facing instances reachable over the network

Discovery Timeline

2024-10-21 - CVE-2024-10201 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10201

Vulnerability Analysis

The Wellchoose Administrative Management System exposes a file upload feature to authenticated users. Server-side logic does not verify that uploaded files match an allow-list of safe types. Attackers submit files with server-executable extensions such as .jsp, .php, or .aspx. The web server then interprets and executes the uploaded content when the attacker requests the resource. This yields remote code execution under the privileges of the web application process. Attackers commonly deploy webshells to maintain persistence, pivot into internal networks, exfiltrate data, or stage further payloads.

Root Cause

The root cause is missing or insufficient validation of uploaded file types. The application relies on client-controlled inputs such as filename extensions or MIME headers rather than enforcing a strict server-side allow-list and content inspection. Uploaded files are stored within a directory that the web server executes, compounding the impact.

Attack Vector

Exploitation requires network access to the application and a valid low-privilege account. The attacker authenticates, invokes the file upload endpoint, and submits a crafted file containing webshell code. The attacker then browses to the uploaded file's URL to trigger execution. No user interaction is required beyond attacker-driven requests. Refer to the TW-CERT Security Advisory for vendor-coordinated details.

Detection Methods for CVE-2024-10201

Indicators of Compromise

Unexpected files with server-executable extensions (.jsp, .php, .aspx, .ashx) created in upload directories after user session activity.
Web access logs showing POST requests to upload endpoints followed by GET requests to attacker-controlled filenames.
Web server process spawning shell interpreters such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
Outbound connections from the web server to unfamiliar external hosts shortly after file upload activity.

Detection Strategies

Monitor upload directories for new files whose extensions or MIME types fall outside an approved list.
Alert on process lineage where the web application service is the parent of interactive shells or scripting hosts.
Inspect HTTP request bodies for known webshell signatures such as eval(, system(, or Runtime.getRuntime().exec.

Monitoring Recommendations

Enable and centralize web server, application, and authentication logs for the Wellchoose system.
Baseline normal upload patterns per account to surface anomalous volumes or filenames.
Correlate authentication events with file creation and subsequent process execution across endpoint telemetry.

How to Mitigate CVE-2024-10201

Immediate Actions Required

Apply the vendor update referenced in the TW-CERT Security Notice as soon as it is available.
Restrict access to the administrative management system to trusted networks or via VPN until patched.
Audit existing upload directories for unauthorized files and remove any webshells discovered.
Rotate credentials for all accounts with upload privileges and review recent authentication logs.

Patch Information

Wellchoose has coordinated disclosure with TW-CERT. Administrators should contact the vendor or consult the TW-CERT advisory to obtain the fixed version and applicable upgrade instructions.

Workarounds

Configure the web server to deny execution of scripts within upload directories using rules such as php_admin_flag engine off or equivalent handler restrictions.
Enforce a server-side allow-list of accepted file extensions and validate file content with magic-byte inspection.
Store uploaded files outside the web root and serve them through a controlled handler that sets non-executable content types.
Place a web application firewall in front of the application to filter uploads containing script signatures.

bash

# Configuration example: block script execution in upload directory (Apache)
<Directory "/var/www/wellchoose/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .phar .jsp .aspx
    AddType text/plain .php .phtml .phar .jsp .aspx
    Options -ExecCGI
</Directory>