CVE-2024-1113: Openbi Openbi RCE Vulnerability

CVE-2024-1113 Overview

A critical unrestricted file upload vulnerability has been identified in openBI versions up to 1.0.8. The vulnerability exists in the uploadUnity function within the file /application/index/controller/Unity.php. Through manipulation of the file argument, an attacker can upload arbitrary files to the server without proper validation, potentially leading to remote code execution. This vulnerability can be exploited remotely without authentication, making it particularly dangerous for exposed openBI installations.

Critical Impact

Remote attackers can upload malicious files to vulnerable openBI servers, potentially achieving complete system compromise through arbitrary code execution.

Affected Products

• openBI versions up to and including 1.0.8
• openBI installations with exposed /application/index/controller/Unity.php endpoint

Discovery Timeline

• 2024-01-31 - CVE-2024-1113 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1113

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the uploadUnity function's failure to properly validate uploaded files before saving them to the server. Without adequate file type restrictions, content validation, or filename sanitization, attackers can upload executable scripts or other malicious payloads.

The exploit has been publicly disclosed, increasing the risk of active exploitation against unpatched systems. The attack requires no authentication and can be initiated remotely over the network, allowing any attacker with network access to the vulnerable endpoint to exploit this flaw.

Root Cause

The root cause is improper input validation in the file upload handling logic within /application/index/controller/Unity.php. The uploadUnity function accepts file uploads through the file parameter without implementing sufficient security controls such as:

• File extension whitelisting
• MIME type validation
• Content inspection for malicious code
• Secure filename generation
• Upload directory restrictions

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can craft a malicious HTTP request to the uploadUnity endpoint, including a weaponized file (such as a PHP webshell) in the file parameter. Upon successful upload, the attacker can access the uploaded file directly to execute arbitrary code on the server.

The vulnerability allows remote code execution by uploading PHP scripts that, when accessed via the web server, execute with the privileges of the web server process. This could lead to complete server compromise, data theft, lateral movement within the network, or use of the compromised server for further attacks.

Detection Methods for CVE-2024-1113

Indicators of Compromise

• Unusual files appearing in upload directories, particularly PHP files or files with double extensions (e.g., .php.jpg)
• Web server access logs showing requests to /application/index/controller/Unity.php with POST methods containing file uploads
• Presence of unexpected executable files or webshells in web-accessible directories
• Outbound network connections from web server processes to unknown external hosts

Detection Strategies

• Monitor HTTP traffic for POST requests to the uploadUnity endpoint with suspicious file attachments
• Implement file integrity monitoring on web-accessible directories to detect unauthorized file additions
• Deploy web application firewalls (WAF) with rules to detect file upload attacks and malicious payloads
• Review web server logs for access patterns consistent with webshell deployment and usage

Monitoring Recommendations

• Enable detailed logging for the openBI application and web server access logs
• Configure alerts for new file creation events in upload directories
• Monitor for process spawning from web server processes (e.g., www-data spawning shell commands)
• Implement network segmentation monitoring to detect lateral movement attempts from compromised servers

How to Mitigate CVE-2024-1113

Immediate Actions Required

• Restrict network access to openBI installations, limiting exposure to trusted networks only
• Implement Web Application Firewall (WAF) rules to block malicious file uploads to the uploadUnity endpoint
• Audit existing upload directories for any unauthorized or suspicious files and remove them
• Consider disabling the uploadUnity function if not required for business operations

Patch Information

Check with the openBI project for security updates addressing this vulnerability. Monitor the official openBI repository and security advisories for patch releases. Organizations should upgrade to a patched version as soon as one becomes available.

For additional technical details, refer to the VulDB entry #252471 or the Zhaoj Blog Post.

Workarounds

• Implement strict file type validation at the web server level using configuration rules to only allow safe file types
• Configure the web server to prevent execution of scripts in upload directories (e.g., disable PHP execution)
• Use network-level access controls to restrict access to the vulnerable endpoint
• Deploy reverse proxy rules to filter and inspect file upload requests before they reach the application

# Apache configuration to disable PHP execution in upload directories
<Directory "/path/to/openbi/uploads">
    php_admin_flag engine off
    <FilesMatch "\.ph(p[3-7]?|tml)$">
        Require all denied
    </FilesMatch>
</Directory>