CVE-2024-1918: Byzoro Smart S42 Platform RCE Vulnerability

CVE-2024-1918 Overview

CVE-2024-1918 is a critical unrestricted file upload vulnerability affecting the Byzoro Smart S42 Management Platform. The vulnerability exists in the /useratte/userattestation.php file, where improper handling of the hidwel parameter allows attackers to upload arbitrary files to the server without proper validation. This flaw can be exploited remotely without authentication, potentially leading to complete system compromise through the execution of malicious code on the affected server.

Critical Impact

This unrestricted file upload vulnerability allows unauthenticated remote attackers to upload and potentially execute arbitrary files on vulnerable Byzoro Smart S42 Management Platform installations, leading to complete system compromise.

Affected Products

• Byzoro Smart S42 Management Platform up to version 20240219
• All prior versions of Byzoro Smart S42 Management Platform
• Systems running vulnerable instances of /useratte/userattestation.php

Discovery Timeline

• 2024-02-27 - CVE-2024-1918 published to NVD
• 2024-12-17 - Last updated in NVD database

Technical Details for CVE-2024-1918

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected endpoint /useratte/userattestation.php fails to properly validate uploaded files through the hidwel parameter. The lack of file type validation, content inspection, or extension filtering allows attackers to upload executable files such as PHP web shells or other malicious scripts. Once uploaded, these files can be accessed and executed on the server, granting the attacker remote code execution capabilities.

The vulnerability is particularly severe because it requires no authentication and can be exploited entirely over the network. An attacker simply needs to craft a malicious HTTP request targeting the vulnerable endpoint with a weaponized file payload. The exploit has been publicly disclosed, increasing the risk of widespread exploitation.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and file upload security controls in the userattestation.php script. The application accepts file uploads through the hidwel parameter without implementing essential security measures such as:

• File extension whitelisting or blacklisting
• MIME type verification
• File content inspection
• Upload directory restrictions preventing script execution
• Randomization of uploaded file names

This oversight allows any file type to be uploaded and stored on the server in an accessible location.

Attack Vector

The attack can be launched remotely over the network without requiring authentication or user interaction. An attacker exploits this vulnerability by:

1. Identifying a vulnerable Byzoro Smart S42 Management Platform instance
2. Crafting a malicious HTTP POST request to /useratte/userattestation.php
3. Including a malicious file (such as a PHP web shell) in the hidwel parameter
4. Accessing the uploaded file through the web server to achieve code execution

The vulnerability allows attackers to bypass security controls entirely, as the file upload mechanism lacks any validation. Technical details and proof-of-concept documentation are available through the GitHub PoC Documentation and VulDB Entry #254839.

Detection Methods for CVE-2024-1918

Indicators of Compromise

• Unexpected files appearing in web-accessible upload directories, particularly files with executable extensions (.php, .phtml, .php5)
• HTTP POST requests to /useratte/userattestation.php containing suspicious file uploads
• Web server logs showing access to newly uploaded files with executable extensions
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor web server logs for POST requests targeting /useratte/userattestation.php with file upload payloads
• Implement file integrity monitoring on directories where uploaded files are stored to detect unauthorized file creation
• Deploy web application firewall (WAF) rules to inspect and block suspicious file upload attempts containing executable content
• Use endpoint detection and response (EDR) solutions to monitor for web shell activity and anomalous process spawning from web server processes

Monitoring Recommendations

• Enable detailed logging for the Byzoro Smart S42 Management Platform application and review logs regularly for suspicious upload activity
• Configure alerts for new file creation in upload directories, especially for files with executable extensions
• Monitor network traffic for indicators of command-and-control communication that may follow successful exploitation
• Implement real-time file scanning on upload directories to detect malicious content

How to Mitigate CVE-2024-1918

Immediate Actions Required

• Restrict network access to the Byzoro Smart S42 Management Platform to trusted IP addresses only using firewall rules
• If possible, disable or remove the /useratte/userattestation.php endpoint until a vendor patch is available
• Implement web application firewall rules to block file upload requests to the vulnerable endpoint
• Conduct an immediate review of upload directories for any suspicious or unexpected files that may indicate prior compromise

Patch Information

At the time of this publication, the vendor (Byzoro) was contacted about this vulnerability but did not respond. No official patch has been released. Organizations should monitor the vendor's official channels for security updates and consider implementing the workarounds listed below until a patch becomes available. Additional vulnerability details can be found at VulDB CTI ID #254839.

Workarounds

• Block access to /useratte/userattestation.php at the web server or reverse proxy level if the functionality is not required
• Implement strict file upload validation at the web application firewall level, blocking uploads of executable file types
• Configure the upload directory with restrictive permissions that prevent script execution (e.g., disable PHP execution in upload directories)
• Deploy network segmentation to limit the potential impact of a compromised management platform

# Apache configuration to disable PHP execution in upload directory
<Directory "/path/to/upload/directory">
    php_admin_flag engine off
    Options -ExecCGI
    RemoveHandler .php .phtml .php5 .php7
</Directory>

# Block access to vulnerable endpoint (Apache)
<Location "/useratte/userattestation.php">
    Require all denied
</Location>