CVE-2024-1035: OpenBI RCE Vulnerability via File Upload

CVE-2024-1035 Overview

A critical unrestricted file upload vulnerability has been identified in openBI versions up to 1.0.8. This vulnerability affects the uploadIcon function within the file /application/index/controller/Icon.php. The flaw allows remote attackers to upload arbitrary files by manipulating the image argument, potentially leading to remote code execution on affected systems.

Critical Impact

Remote attackers can exploit this unrestricted file upload vulnerability to upload malicious files, potentially achieving remote code execution on vulnerable openBI installations without requiring authentication.

Affected Products

• openBI versions up to and including 1.0.8
• openbi_project openbi (all versions prior to patch)

Discovery Timeline

• January 30, 2024 - CVE-2024-1035 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-1035

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The uploadIcon function in openBI fails to properly validate uploaded files, allowing attackers to bypass intended file type restrictions. The vulnerable endpoint accepts file uploads through the image parameter without adequate verification of file contents or extensions.

The attack can be initiated remotely over the network, requires no authentication or user interaction, and provides attackers with a straightforward path to compromise the confidentiality, integrity, and availability of the affected system. The exploit has been publicly disclosed, increasing the risk of exploitation in the wild.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation within the uploadIcon function located at /application/index/controller/Icon.php. The function fails to implement proper file type verification, content-type validation, or extension whitelisting when processing the image argument. This allows malicious actors to upload files with dangerous extensions such as .php, potentially enabling server-side code execution.

Attack Vector

The attack is network-based and can be executed remotely without any prior authentication. An attacker can craft a malicious HTTP request to the vulnerable endpoint with a specially crafted file payload. When the server processes this upload request without proper validation, the malicious file is stored on the server. If the uploaded file contains executable code (such as a PHP webshell), the attacker can subsequently access this file to execute arbitrary commands on the server.

The exploitation mechanism involves sending a crafted multipart form request to the vulnerable uploadIcon endpoint. The attacker manipulates the image parameter to include a malicious file, bypassing any client-side validation. Once uploaded, the file can be accessed directly if the upload directory is web-accessible, allowing for immediate code execution. For detailed technical analysis, refer to the Zhao Jin Blog Post and VulDB advisory.

Detection Methods for CVE-2024-1035

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .phar) in the icon upload directory
• HTTP POST requests to /application/index/controller/Icon.php with suspicious file payloads
• Web server access logs showing requests to newly created files in upload directories
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor file system changes in openBI upload directories for unauthorized file creation
• Implement web application firewall (WAF) rules to detect file upload attacks targeting the uploadIcon endpoint
• Review web server logs for POST requests to /application/index/controller/Icon.php with unusual content types
• Deploy endpoint detection to identify webshell patterns and suspicious PHP file executions

Monitoring Recommendations

• Enable detailed logging on the openBI application to track all file upload activities
• Configure file integrity monitoring (FIM) on web-accessible directories
• Set up alerts for execution of newly created files in upload locations
• Monitor for indicators of webshell activity including unusual command execution patterns

How to Mitigate CVE-2024-1035

Immediate Actions Required

• Restrict network access to openBI installations until patching is complete
• Implement strict file upload validation at the web application firewall level
• Review and remove any suspicious files from upload directories
• Consider temporarily disabling the icon upload functionality if not critical to operations

Patch Information

No official vendor patch information is available at this time. Organizations using openBI versions up to 1.0.8 should monitor the VulDB advisory for updates on available fixes. Contact the openBI project maintainers for guidance on remediation options.

Workarounds

• Implement server-side file type validation that checks both file extension and MIME type
• Configure web server to prevent execution of uploaded files in the upload directory
• Restrict file uploads to specific allowed extensions using an allowlist approach
• Use a separate, non-executable storage location for uploaded files

# Apache configuration to prevent PHP execution in upload directories
<Directory "/path/to/openbi/uploads">
    php_admin_flag engine off
    <FilesMatch "\.ph(p[345]?|t|tml)$">
        Require all denied
    </FilesMatch>
</Directory>