CVE-2024-13134: Zerowdd Studentmanager RCE Vulnerability

CVE-2024-13134 Overview

CVE-2024-13134 is an unrestricted file upload vulnerability in ZeroWdd studentmanager 1.0, an open-source student management application. The flaw resides in the addTeacher and editTeacher functions within src/main/java/com/wdd/studentmanager/controller/TeacherController.java. Attackers can manipulate the file argument to upload arbitrary files without proper validation. The vulnerability is remotely exploitable and requires low-level authentication. Public disclosure has occurred through VulDB and the project's GitHub issue tracker, increasing the risk of opportunistic exploitation against exposed deployments. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Authenticated remote attackers can upload arbitrary files through the teacher management endpoints, potentially leading to code execution or persistent web shells.

Affected Products

ZeroWdd studentmanager 1.0
Component: TeacherController.java
Functions: addTeacher / editTeacher

Discovery Timeline

2025-01-05 - CVE-2024-13134 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13134

Vulnerability Analysis

The vulnerability exists in the teacher management workflow of the studentmanager application. The addTeacher and editTeacher handlers accept a file parameter without enforcing restrictions on file type, extension, content, or destination path. An attacker with a valid low-privilege session can submit a crafted multipart request that places an arbitrary file within the application's storage location.

Because the application is a Java web application, uploaded artifacts such as JSP files or executable scripts may be reachable through the web server. This creates a path from authenticated file upload to remote code execution when the upload directory is served by the application container.

Root Cause

The root cause is missing server-side validation on the uploaded file argument. The controller does not verify MIME type, file extension allowlists, magic bytes, or size limits before persisting the file. There is also no evidence of filename sanitization to prevent path traversal or overwriting of existing resources.

Attack Vector

Exploitation requires network access to the studentmanager application and valid credentials for the teacher management functionality. The attacker crafts an HTTP request to the vulnerable endpoint with a malicious payload in the file field. Public disclosure of the exploit through the GitHub issue tracker and VulDB entry 290208 provides technical detail sufficient to reproduce the attack.

Refer to the GitHub issue comment for reproduction steps documented by the reporter.

Detection Methods for CVE-2024-13134

Indicators of Compromise

Unexpected files with executable extensions (.jsp, .jspx, .war, .sh) in the studentmanager upload directory
HTTP POST requests to addTeacher or editTeacher endpoints containing multipart uploads with non-image content types
New outbound network connections initiated by the Java application process shortly after upload activity
Anomalous process creation by the servlet container spawning shells or interpreters

Detection Strategies

Inspect web server access logs for requests to teacher controller endpoints with attachments larger than expected profile images
Monitor filesystem changes in the application's upload directory for files with server-executable extensions
Correlate authenticated session activity with file write events to identify low-privilege accounts writing unusual artifacts

Monitoring Recommendations

Enable file integrity monitoring on the studentmanager web root and upload directories
Log all multipart upload requests with source IP, user identifier, filename, and content type
Alert on any process spawned by the servlet container that is not part of a documented baseline

How to Mitigate CVE-2024-13134

Immediate Actions Required

Restrict network exposure of the studentmanager application to trusted internal networks only
Revoke or rotate credentials for any teacher accounts that may have been abused
Audit the upload directory for unauthorized files and remove any executable content
Disable execution of scripts within upload directories at the servlet container level

Patch Information

No official vendor patch is listed for CVE-2024-13134 in the NVD or vendor references. Operators should track the project issue tracker for updates. Because studentmanager 1.0 appears to be an educational project without an active maintenance branch, organizations running it in production should plan migration to a maintained alternative.

Workarounds

Implement a reverse proxy rule that blocks uploads with extensions other than approved image types (.jpg, .png, .gif)
Configure the servlet container to treat the upload directory as static-only, disabling JSP and script execution
Add server-side validation in a forked build to enforce MIME type checks and rename uploaded files to non-executable extensions
Place the application behind an authenticated VPN and remove direct internet exposure

bash

# Example nginx rule to block executable uploads to the teacher endpoints
location ~ ^/teacher/(addTeacher|editTeacher) {
    client_max_body_size 2m;
    if ($request_method = POST) {
        if ($http_content_type !~* "image/(jpeg|png|gif)") {
            return 403;
        }
    }
    proxy_pass http://studentmanager_backend;
}

# Deny script execution in the upload directory
location ~* ^/uploads/.*\.(jsp|jspx|war|sh|php)$ {
    deny all;
}