CVE-2024-1921: Osuuu Lightpicture RCE Vulnerability

CVE-2024-1921 Overview

A critical unrestricted file upload vulnerability has been identified in osuuu LightPicture, a web-based image hosting application. The vulnerability exists in the /app/controller/Setup.php file, where insufficient validation of uploaded files allows attackers to upload arbitrary files, including malicious scripts, to the server. This flaw can be exploited remotely without authentication, potentially leading to complete server compromise.

Critical Impact

Remote attackers can upload malicious files to vulnerable LightPicture installations, potentially achieving remote code execution and full system compromise without any authentication required.

Affected Products

• osuuu LightPicture versions up to and including 1.2.2

Discovery Timeline

• 2024-02-27 - CVE-2024-1921 published to NVD
• 2024-12-18 - Last updated in NVD database

Technical Details for CVE-2024-1921

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected component, /app/controller/Setup.php, fails to properly validate or restrict the types of files that can be uploaded through the application's setup functionality. Without proper file type validation, content-type verification, or extension filtering, attackers can bypass any intended restrictions and upload executable files such as PHP web shells.

The attack can be launched remotely over the network, requires no user interaction, and does not require any authentication or privileges. Upon successful exploitation, attackers gain the ability to execute arbitrary code on the server, read sensitive data, modify application files, and potentially pivot to other systems on the network.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and file type restrictions in the file upload handling logic within Setup.php. The application does not implement sufficient checks to verify that uploaded files are safe, including:

• No validation of file extensions against an allowlist
• Lack of content-type verification or magic byte checking
• Missing restrictions on where uploaded files are stored
• No renaming of uploaded files to prevent direct execution

Attack Vector

The vulnerability is exploitable via the network attack vector. An attacker can craft a malicious HTTP request containing a dangerous file (such as a PHP web shell) and submit it to the vulnerable endpoint. Since no authentication is required and the attack complexity is low, any remote attacker with network access to the application can exploit this vulnerability.

The exploit has been publicly disclosed, and technical details are available through external resources. Attackers typically follow this exploitation pattern:

1. Identify a vulnerable LightPicture installation running version 1.2.2 or earlier
2. Craft a malicious file (e.g., PHP web shell) disguised or submitted directly
3. Upload the file through the vulnerable setup controller endpoint
4. Access the uploaded file to execute arbitrary commands on the server

For detailed technical information about the vulnerability mechanism, refer to the Zhao Jin Note Share or the VulDB entry #254856.

Detection Methods for CVE-2024-1921

Indicators of Compromise

• Unexpected PHP files or scripts appearing in upload directories
• Web shell signatures in uploaded files (common patterns include eval(), base64_decode(), system(), shell_exec())
• HTTP POST requests to /app/controller/Setup.php with file upload payloads containing executable content
• Anomalous outbound connections or command execution from the web server process

Detection Strategies

• Monitor web server logs for suspicious POST requests to the Setup.php endpoint, especially those with file upload content
• Implement file integrity monitoring on web application directories to detect unauthorized file additions
• Deploy web application firewalls (WAF) with rules to detect and block malicious file upload attempts
• Use endpoint detection solutions to identify web shell activity and suspicious process spawning from web server processes

Monitoring Recommendations

• Enable detailed logging for file upload operations in the LightPicture application
• Configure alerts for new executable files appearing in web-accessible directories
• Monitor for unusual network traffic patterns originating from the web server
• Implement regular security scans of the web application directory structure

How to Mitigate CVE-2024-1921

Immediate Actions Required

• Upgrade LightPicture to a patched version if available from the vendor
• If no patch is available, consider taking the application offline or restricting network access to trusted sources only
• Remove or disable the vulnerable Setup.php controller if the setup functionality is not required
• Implement network segmentation to limit the potential impact of a compromise

Patch Information

At the time of this writing, users should check the official osuuu LightPicture repository or vendor communications for security patches addressing this vulnerability. Organizations running affected versions should monitor for updates and apply patches immediately upon release. For additional details, consult the VulDB CTI entry.

Workarounds

• Restrict access to the /app/controller/Setup.php endpoint using web server configuration (e.g., IP allowlisting or authentication)
• Implement a web application firewall with rules to block file upload requests containing executable content
• Configure the web server to prevent execution of uploaded files by disabling PHP execution in upload directories
• Apply the principle of least privilege to the web server user account to limit post-exploitation impact

# Apache configuration to restrict access to Setup.php
<Files "Setup.php">
    Require ip 127.0.0.1
    Require ip 10.0.0.0/8
</Files>

# Disable PHP execution in upload directories
<Directory "/var/www/html/uploads">
    php_admin_flag engine Off
</Directory>