CVE-2024-13210: Donglight Bookstore RCE Vulnerability

CVE-2024-13210 Overview

CVE-2024-13210 is an unrestricted file upload vulnerability in Donglight Bookstore 1.0, an open-source e-commerce book store application. The flaw resides in the uploadPicture function inside src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController.java. An authenticated administrator can manipulate the pictureFile argument to upload arbitrary file types without validation. The issue is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and [CWE-284] (Improper Access Control). The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
A remote attacker with high privileges can upload arbitrary files to the server, potentially leading to persistence, defacement, or code execution depending on the runtime configuration.

Affected Products

Donglight Bookstore 1.0.0
AdminBookController.java admin upload endpoint
Deployments exposing the admin interface over the network

Discovery Timeline

2025-01-09 - CVE-2024-13210 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13210

Vulnerability Analysis

The vulnerability exists in the administrative book management workflow of Donglight Bookstore. The uploadPicture handler in AdminBookController.java accepts a pictureFile multipart parameter intended for book cover images. The controller writes the received file to disk without enforcing MIME type checks, file extension allowlists, or content inspection. An attacker who supplies a file with an executable extension, such as a JSP or servlet-compatible payload, can place it in a location reachable by the application server. Because the vulnerability requires administrative privileges, the primary threat scenarios involve compromised admin credentials or a malicious insider. The public disclosure of exploitation details lowers the barrier for reproduction.

Root Cause

The root cause is missing server-side validation on file uploads. The uploadPicture method trusts the client-supplied file name and content, failing to validate extension, content type, and magic bytes. Combined with weak access control enforcement on the upload path, this creates the conditions described in [CWE-434] and [CWE-284].

Attack Vector

The attack is executed remotely over HTTP. An authenticated administrator submits a crafted multipart POST request to the picture upload endpoint with a payload file that carries a server-executable extension. If the application writes the file inside the web root without rewriting the extension or sandboxing storage, the attacker can then request the uploaded resource and trigger execution in the servlet container.

No verified proof-of-concept code is available. Refer to the GitHub Issue #10 and VulDB entry #290815 for the disclosed technical details.

Detection Methods for CVE-2024-13210

Indicators of Compromise

Unexpected files with .jsp, .jspx, .war, or other executable extensions inside the application's picture upload directory.
Admin session activity originating from unusual IP addresses or geographies immediately preceding file writes.
Access logs showing GET requests to newly created files under the image upload path shortly after a POST to uploadPicture.

Detection Strategies

Inspect multipart POST requests to the AdminBookController upload endpoint and alert on non-image content types or double extensions in pictureFile filenames.
Correlate administrative logins with subsequent file creation events in the web root using file integrity monitoring.
Scan the upload storage directory for files whose magic bytes do not match a permitted image format.

Monitoring Recommendations

Enable verbose access and application logging for administrative controller paths and centralize logs for retention and query.
Baseline normal admin upload behavior and alert on deviations in upload frequency, file size, or extension mix.
Monitor outbound connections from the application host that could indicate execution of a dropped payload.

How to Mitigate CVE-2024-13210

Immediate Actions Required

Restrict network reachability of the /admin interface to trusted management networks or a VPN.
Rotate administrator credentials and enforce multi-factor authentication on the admin login path.
Audit the picture upload directory for unauthorized files and remove any that do not match expected image formats.

Patch Information

No official vendor patch is referenced in the CVE record. Track the upstream project via GitHub Issue #10 for remediation status. Until a fix is available, apply the workarounds below and consider forking the project to add server-side upload validation to AdminBookController.uploadPicture.

Workarounds

Modify uploadPicture to enforce an allowlist of image extensions and validate content via magic-byte inspection before writing to disk.
Store uploaded images outside the web root and serve them through a dedicated handler that sets a non-executable content type.
Configure the servlet container to disable execution of scripts within the picture upload directory using deployment descriptor rules.
Deploy a web application firewall rule that blocks multipart uploads whose declared content type is not an image format on the admin upload path.

bash

# Example Nginx configuration to block script execution in the upload directory
location ^~ /uploads/pictures/ {
    default_type application/octet-stream;
    location ~* \.(jsp|jspx|war|sh|php)$ {
        deny all;
        return 403;
    }
}