CVE-2024-2565: Pandax Pandax RCE Vulnerability

CVE-2024-2565 Overview

A critical unrestricted file upload vulnerability has been discovered in PandaXGO PandaX up to version 20240310. The vulnerability exists in the File Extension Handler component, specifically within the file /apps/system/router/upload.go. An attacker can manipulate the file argument to upload arbitrary files without proper extension validation, potentially leading to remote code execution on the affected system.

Critical Impact

This vulnerability allows remote attackers to upload malicious files without authentication, potentially leading to complete system compromise through arbitrary code execution.

Affected Products

• PandaXGO PandaX versions up to and including 20240310
• All installations using the vulnerable /apps/system/router/upload.go component

Discovery Timeline

• 2024-03-17 - CVE-2024-2565 published to NVD
• 2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-2565

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the file upload handling mechanism within PandaX's system router component. The application fails to properly validate or restrict file extensions during the upload process, allowing attackers to bypass intended security controls and upload files with dangerous extensions such as executable scripts or server-side code.

The attack can be launched remotely without requiring any user interaction or prior authentication. Once a malicious file is uploaded, an attacker could potentially execute arbitrary code on the server, access sensitive data, or establish persistence within the compromised system.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the upload.go file's File Extension Handler. The application does not implement proper file type validation, extension whitelisting, or content-type verification for uploaded files. This allows attackers to bypass file type restrictions by manipulating the file argument parameter.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker can craft a malicious HTTP request containing a dangerous file type (such as a web shell or executable script) and upload it directly to the vulnerable endpoint. The lack of authentication requirements means this attack can be performed by any remote attacker with network access to the vulnerable PandaX instance.

The exploit has been publicly disclosed, increasing the risk of widespread exploitation. Attackers typically leverage such vulnerabilities to upload PHP, Go, or other executable files that can be accessed through a web browser to gain shell access to the server.

Detection Methods for CVE-2024-2565

Indicators of Compromise

• Unexpected files with executable extensions (.php, .jsp, .go, .py, .sh) in upload directories
• Suspicious HTTP POST requests to /apps/system/router/upload.go endpoints
• Web shell files or backdoors present in accessible web directories
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor HTTP traffic for file upload requests containing suspicious file extensions
• Implement file integrity monitoring on upload directories to detect unauthorized file additions
• Review web server access logs for requests to newly created files with executable extensions
• Deploy web application firewall (WAF) rules to block uploads of dangerous file types

Monitoring Recommendations

• Enable detailed logging for all file upload operations in PandaX
• Set up alerts for file creation events in upload directories with executable extensions
• Monitor system process activity for unexpected child processes spawned by the web server
• Implement network segmentation to limit potential lateral movement after compromise

How to Mitigate CVE-2024-2565

Immediate Actions Required

• Restrict network access to PandaX instances to trusted IP addresses only
• Implement web application firewall rules to block malicious file uploads
• Review upload directories for any suspicious or unexpected files and remove them
• Consider temporarily disabling the file upload functionality until a patch is applied

Patch Information

As of the last CVE update, users should check the PandaXGO GitHub repository for the latest security patches and updates. It is recommended to upgrade to a version newer than 20240310 that addresses this vulnerability. Monitor the official PandaX project channels for security advisories.

Additional vulnerability details can be found in the VulDB entry #257064.

Workarounds

• Implement a reverse proxy with strict file extension validation in front of PandaX
• Add server-side validation to restrict uploaded file types to a whitelist of safe extensions
• Configure the web server to prevent execution of uploaded files in upload directories
• Deploy network-level access controls to limit who can access the upload functionality

# Example: Nginx configuration to prevent script execution in upload directories
location /uploads {
    # Disable script execution
    location ~ \.(php|jsp|py|go|sh|pl|cgi)$ {
        deny all;
    }
    
    # Only allow specific safe file types
    if ($request_filename !~* \.(jpg|jpeg|png|gif|pdf|doc|docx)$) {
        return 403;
    }
}