CVE-2024-13212 Overview
CVE-2024-13212 is an unrestricted file upload vulnerability in SingMR HouseRent 1.0. The flaw exists in the singleUpload/upload function within src/main/java/com/house/wym/controller/AddHouseController.java. Attackers can manipulate the file argument to upload arbitrary files to the application server. The vulnerability is remotely exploitable and requires only low-privileged authentication. Public disclosure has occurred through VulDB and the project's GitHub issue tracker, increasing exposure risk for deployments still running the affected release.
Critical Impact
Authenticated remote attackers can upload arbitrary files through the singleUpload/upload endpoint, enabling potential webshell deployment and further compromise of the HouseRent application.
Affected Products
- SingMR HouseRent 1.0
- AddHouseController.java component (singleUpload/upload function)
- Deployments exposing the file upload endpoint over the network
Discovery Timeline
- 2025-01-09 - CVE-2024-13212 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13212
Vulnerability Analysis
The vulnerability resides in the singleUpload/upload function of AddHouseController.java within the HouseRent Spring-based Java web application. The controller accepts a file parameter without enforcing sufficient restrictions on file type, extension, content, or destination path. This category of weakness is tracked as [CWE-284: Improper Access Control].
An authenticated attacker submitting a crafted multipart request can place executable content into a web-accessible directory. If the application server processes uploaded files as scripts, the attacker gains code execution in the context of the application. Even without direct execution, arbitrary file writes can corrupt application data, overwrite configuration, or stage secondary payloads.
The issue was disclosed publicly through GitHub Issue #13 and cataloged in VulDB Analysis #290817.
Root Cause
The root cause is missing validation logic in the upload handler. The controller trusts client-supplied metadata and does not enforce an allowlist of MIME types or file extensions. No path canonicalization or randomization of stored file names appears to be applied.
Attack Vector
An attacker with valid low-privilege credentials sends an HTTP POST request to the singleUpload/upload endpoint containing a malicious file. The manipulated file parameter carries content such as a JSP webshell or other executable payload. Once written to disk under a web-served path, the file can be requested directly to trigger execution or misuse.
No verified public exploit code is available. See the VulDB submission #471441 for the researcher-supplied technical description.
Detection Methods for CVE-2024-13212
Indicators of Compromise
- HTTP POST requests to singleUpload/upload containing multipart payloads with executable extensions such as .jsp, .jspx, .war, or .sh.
- Newly created files in HouseRent upload directories with server-side script extensions or unusual MIME types.
- Outbound connections from the application server process originating shortly after upload activity.
Detection Strategies
- Inspect web server and application logs for calls to the singleUpload/upload endpoint paired with suspicious filenames or oversized payloads.
- Deploy file integrity monitoring on the upload directory to alert on creation of executable content.
- Correlate authentication events with upload activity to identify low-privileged accounts abusing the endpoint.
Monitoring Recommendations
- Enable verbose access logging for the AddHouseController routes and forward events to a centralized analytics platform.
- Track process creation from the Java application user, especially shell invocations following upload requests.
- Alert on any web-accessible directory writes that occur outside expected deployment workflows.
How to Mitigate CVE-2024-13212
Immediate Actions Required
- Restrict network exposure of the HouseRent singleUpload/upload endpoint to trusted networks or VPN-connected clients.
- Revoke or rotate credentials for accounts that have accessed the upload endpoint since deployment.
- Audit the upload directory and quarantine any files with executable server-side extensions.
Patch Information
No vendor patch has been published at the time of NVD entry. HouseRent 1.0 remains the only affected release identified in the CVE record. Monitor the SingMR HouseRent GitHub repository and VulDB entry #290817 for updates.
Workarounds
- Modify AddHouseController.java to enforce a strict allowlist of permitted MIME types and file extensions for the file parameter.
- Store uploaded files outside the web root and serve them through a controlled handler that sets a non-executable content type.
- Rename uploaded files to server-generated identifiers and strip client-supplied extensions and path components.
- Place a web application firewall rule in front of the endpoint to block multipart requests containing script extensions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
