CVE-2024-2406: Gacjie Server RCE Vulnerability

CVE-2024-2406 Overview

A critical unrestricted file upload vulnerability has been identified in Gacjie Server versions up to 1.0. This vulnerability affects the index function within the file /app/admin/controller/Upload.php. Through manipulation of the file argument, an attacker can upload arbitrary files to the server without proper validation or restrictions. The attack can be initiated remotely, making this a high-risk vulnerability for organizations running affected versions of Gacjie Server.

Critical Impact

This unrestricted file upload vulnerability allows remote attackers to upload malicious files, potentially leading to complete server compromise, remote code execution, and unauthorized access to sensitive data.

Affected Products

• Gacjie Server versions up to and including 1.0
• gacjie_server_project gacjie_server (all versions through 1.0)

Discovery Timeline

• 2024-03-12 - CVE-2024-2406 published to NVD
• 2025-01-22 - Last updated in NVD database

Technical Details for CVE-2024-2406

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the insufficient validation of uploaded files within the Gacjie Server's administrative upload controller. The index function in /app/admin/controller/Upload.php fails to properly sanitize or restrict the types of files that can be uploaded through the file parameter.

When a file upload request is processed, the application does not adequately verify the file extension, MIME type, or content of the uploaded file. This allows attackers to bypass intended security controls and upload executable scripts (such as PHP web shells) or other malicious content directly to the server.

Root Cause

The root cause of this vulnerability stems from improper input validation in the file upload handling mechanism. The Upload.php controller's index function accepts file uploads without implementing necessary security checks including:

• File extension whitelisting/blacklisting
• MIME type verification
• File content inspection
• Filename sanitization

This lack of validation allows attackers to upload files with executable extensions that can then be accessed and executed on the server.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can craft a malicious HTTP request to the vulnerable upload endpoint, including a specially crafted file in the file parameter. Once uploaded, if the file is stored in a web-accessible directory, the attacker can directly access the uploaded file to execute arbitrary code on the server.

The exploitation process typically involves uploading a web shell (such as a PHP backdoor) which then provides the attacker with persistent remote access to the compromised server, enabling further malicious activities including data exfiltration, lateral movement, and system manipulation.

Detection Methods for CVE-2024-2406

Indicators of Compromise

• Unexpected file uploads in web-accessible directories, particularly PHP files with suspicious names or obfuscated content
• HTTP POST requests to /app/admin/controller/Upload.php containing unusual file types or executable content
• New or modified files in upload directories with recent timestamps that were not created by legitimate administrative actions
• Web server logs showing access to newly uploaded files with executable extensions

Detection Strategies

• Monitor web server access logs for POST requests to the /app/admin/controller/Upload.php endpoint
• Implement file integrity monitoring (FIM) on upload directories to detect unauthorized file additions
• Deploy web application firewall (WAF) rules to inspect and block malicious file upload attempts
• Review uploaded files for common web shell signatures and patterns

Monitoring Recommendations

• Enable detailed logging on the Gacjie Server application to capture all file upload activities
• Set up alerts for file creation events in web-accessible directories
• Regularly audit uploaded content for malicious files or unexpected executable scripts
• Monitor outbound network connections from the web server for potential command and control communications

How to Mitigate CVE-2024-2406

Immediate Actions Required

• Restrict access to the /app/admin/controller/Upload.php endpoint using firewall rules or web server configuration
• Implement strict file type validation at the application or web server level
• Move uploaded files to a non-web-accessible directory and serve them through a secure proxy
• Review and remove any suspicious files that may have been uploaded to the server

Patch Information

No official vendor patch has been documented at this time. Organizations should monitor the VulDB advisory for updates regarding security fixes. Additional technical details can be found in the Zhao Jin Note Share resource.

Workarounds

• Implement a whitelist of allowed file extensions (e.g., images only: .jpg, .png, .gif) at the web server level
• Configure the web server to prevent execution of scripts in upload directories using directives such as disabling PHP processing
• Deploy a web application firewall with rules to detect and block malicious file uploads
• Restrict access to administrative upload functionality to trusted IP addresses only

# Example Apache configuration to disable PHP execution in uploads directory
<Directory "/path/to/gacjie/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
        Require all denied
    </FilesMatch>
</Directory>