CVE-2024-13133: Zerowdd Studentmanager Auth Bypass Vulnerability

CVE-2024-13133 Overview

CVE-2024-13133 is an unrestricted file upload vulnerability in ZeroWdd studentmanager 1.0, an open-source student management application. The flaw resides in the addStudent and editStudent functions within src/main/java/com/wdd/studentmanager/controller/StudentController.java. Attackers can manipulate the file argument to upload arbitrary content to the server. The issue is remotely exploitable and requires only low-privileged authenticated access. Public disclosure has occurred through GitHub and VulDB, increasing the risk of opportunistic exploitation against exposed deployments. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the student management endpoints, potentially leading to malicious content hosting and follow-on attacks against application users.

Affected Products

ZeroWdd studentmanager 1.0
StudentController.javaaddStudent function
StudentController.javaeditStudent function

Discovery Timeline

2025-01-05 - CVE-2024-13133 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13133

Vulnerability Analysis

The vulnerability exists in the student management workflow of the Java Spring-based studentmanager application. The addStudent and editStudent controller methods accept a file parameter representing an uploaded student avatar or attachment. The controller does not enforce restrictions on file type, extension, MIME content, or destination path before persisting the upload to the server filesystem. Because the endpoint is reachable over the network and requires only low-level authentication, attackers with a valid account can deliver arbitrary payloads. Public discussion of the flaw is available on the GitHub issue tracker and in VulDB entry #290207.

Root Cause

The root cause is the absence of server-side validation on the file argument passed to addStudent and editStudent. The controller trusts client-supplied metadata and does not verify extension allow-lists, magic bytes, or storage location constraints. This falls under CWE-284: Improper Access Control because the application fails to restrict which resources a user can modify through the upload interface.

Attack Vector

An authenticated attacker submits a crafted multipart request to the student add or edit endpoint, replacing the expected avatar with an executable or scripted payload. Because the storage directory and served filename are attacker-influenced, the uploaded artifact may be retrievable through the web root. No user interaction is required beyond the attacker session. Verified public exploit code is not currently referenced in the CVE record, but the vulnerability details have been disclosed publicly.

No verified proof-of-concept code is published in the CVE references. See the GitHub issue detail for the technical description.

Detection Methods for CVE-2024-13133

Indicators of Compromise

Unexpected files with executable or script extensions (.jsp, .jspx, .war, .sh, .html) in upload directories used by studentmanager.
Requests to /addStudent or /editStudent endpoints containing multipart payloads with non-image Content-Type values.
New files in the application upload path whose owner or timestamp does not correspond to legitimate administrative activity.

Detection Strategies

Inspect web server and application logs for POST requests to student controller endpoints with unusually large payloads or non-standard file extensions.
Deploy filesystem integrity monitoring on the studentmanager upload directory to alert on new or modified files.
Correlate authentication logs with upload activity to identify low-privileged accounts performing anomalous file operations.

Monitoring Recommendations

Enable verbose logging of Spring MultipartFile handling to record filename, size, and content type for every upload.
Route web application firewall (WAF) logs into a centralized analytics platform to hunt for suspicious upload patterns.
Alert on any process spawned from the web application user account that reads recently uploaded files.

How to Mitigate CVE-2024-13133

Immediate Actions Required

Restrict network exposure of studentmanager 1.0 instances to trusted internal networks until a fix is applied.
Disable or place authentication in front of the addStudent and editStudent endpoints if they are not required.
Audit existing upload directories for unauthorized files and remove any that are not recognized.

Patch Information

No vendor patch is referenced in the CVE record. ZeroWdd studentmanager is an open-source project hosted on GitHub, and remediation requires source-level changes to the StudentController upload logic. Refer to the project repository and the associated issue for community discussion.

Workarounds

Modify addStudent and editStudent to enforce an allow-list of image extensions and validate file magic bytes before persisting uploads.
Store uploaded files outside the web root and serve them through a controller that sets a safe Content-Type and disables script execution.
Rename uploaded files to server-generated identifiers to prevent attacker control over stored filenames.
Apply reverse-proxy rules to block execution of dynamic content (.jsp, .jspx) from user upload directories.

bash

# Example nginx rule to prevent script execution in the uploads directory
location ^~ /uploads/ {
    default_type application/octet-stream;
    add_header Content-Disposition "attachment";
    location ~ \.(jsp|jspx|war|sh|php)$ { deny all; }
}