CVE-2024-11017: Vice Webopac RCE Vulnerability

CVE-2024-11017 Overview

CVE-2024-11017 is an unrestricted file upload vulnerability in Webopac from Grand Vice info. The application fails to validate uploaded file types, allowing authenticated attackers with regular user privileges to upload malicious files. Attackers can upload webshells and execute them on the server, resulting in arbitrary code execution. The vulnerability is categorized under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and is exploitable over the network with low attack complexity.

Critical Impact
Authenticated attackers can upload webshells to Webopac servers and achieve arbitrary code execution, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Grand Vice info Webopac (all versions prior to vendor patch)
Deployments exposing the file upload functionality to authenticated users
Web-facing Webopac instances accessible over the network

Discovery Timeline

2024-11-11 - CVE-2024-11017 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11017

Vulnerability Analysis

The vulnerability resides in the file upload handler of the Webopac application. The application accepts user-supplied files without enforcing restrictions on file type, extension, or content. This omission allows an authenticated attacker to submit executable server-side scripts, such as PHP, ASP, or JSP webshells, through the same upload channel intended for benign document formats.

Once a webshell reaches the web-accessible directory, the attacker requests the file through the browser. The web server processes the script and returns command execution capability under the privileges of the web server process. This gives the attacker a foothold to enumerate the host, pivot into internal systems, and stage additional payloads.

The attack requires only a low-privileged authenticated account, which lowers the barrier for internal actors or attackers who obtain credentials through phishing or credential stuffing. Impact spans confidentiality, integrity, and availability because the resulting code execution runs in the server context.

Root Cause

The root cause is missing server-side validation of uploaded file MIME types, extensions, and magic bytes. The application also stores uploaded files in a directory where the web server interprets script content instead of serving files as static assets.

Attack Vector

Exploitation follows a standard unrestricted upload pattern. The attacker authenticates to Webopac with a regular user account, submits a crafted multipart request containing a script file, then issues an HTTP request to the uploaded file path to trigger execution. See the TWCCERT Security Advisory for additional details.

// No verified public proof-of-concept code is available.
// Refer to the TWCCERT advisory for technical details.

Detection Methods for CVE-2024-11017

Indicators of Compromise

New script files (.php, .jsp, .asp, .aspx) appearing in Webopac upload directories
HTTP POST requests to upload endpoints followed by GET requests to newly created files with script extensions
Web server processes spawning shell interpreters such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash
Outbound network connections initiated by the Webopac web server process to unfamiliar hosts

Detection Strategies

Monitor file creation events in web-accessible directories and alert on executable script extensions
Correlate authenticated upload activity with immediate GET requests to the same file path
Inspect HTTP request bodies for known webshell signatures such as eval(, system(, or base64_decode(
Baseline expected upload MIME types and flag deviations at the web application firewall layer

Monitoring Recommendations

Enable verbose logging on the Webopac upload endpoint, capturing username, filename, and content type
Forward web server access logs and process telemetry to a centralized SIEM for correlation
Alert on child process creation from the web server user account, which is unusual under normal operation
Review authentication logs for anomalous regular-user activity preceding file uploads

How to Mitigate CVE-2024-11017

Immediate Actions Required

Apply the vendor-supplied patch from Grand Vice info as soon as it is available through the TWCCERT advisory channel
Restrict access to the Webopac upload functionality to trusted networks until patching is complete
Audit existing upload directories for unauthorized script files and remove any discovered webshells
Rotate credentials for any accounts with upload privileges

Patch Information

Grand Vice info has coordinated disclosure with TWCCERT. Administrators should contact the vendor or consult the TWCCERT Security Advisory for the current fixed version and upgrade instructions.

Workarounds

Configure the web server to deny script execution in upload directories using directives that treat the path as static content only
Deploy a web application firewall rule that blocks uploads with executable extensions or script content signatures
Enforce server-side allowlists that validate MIME type, extension, and magic bytes before writing files to disk
Store uploaded files outside the web root and serve them through a controlled handler that sets Content-Type explicitly

bash

# Example Apache configuration to disable script execution in the upload directory
<Directory "/var/www/webopac/uploads">
    php_flag engine off
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7
    RemoveType .php .phtml .php3 .php4 .php5 .php7
    <FilesMatch "\.(php|phtml|jsp|asp|aspx|cgi|pl)$">
        Require all denied
    </FilesMatch>
</Directory>