CVE-2024-2599: AMSS++ File Upload RCE Vulnerability

CVE-2024-2599 Overview

CVE-2024-2599 is a file upload restriction evasion vulnerability in AMSS++ version 4.31. An authenticated attacker can bypass file type validation controls and upload a webshell to the application. Successful exploitation yields remote code execution (RCE) on the underlying host, allowing full compromise of the AMSS++ infrastructure. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type. Attackers reach the flaw over the network with low privileges and no user interaction, which broadens the pool of viable threat actors to any account holder on the platform.

Critical Impact
Authenticated attackers can upload a webshell to AMSS++ 4.31 and execute arbitrary commands, resulting in complete infrastructure compromise.

Affected Products

AMSS++ version 4.31
AMSS++ Project deployments running the vulnerable release
Environments where AMSS++ file upload functionality is exposed to authenticated users

Discovery Timeline

2024-03-18 - CVE-2024-2599 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2599

Vulnerability Analysis

The flaw resides in the file upload handler within AMSS++ 4.31. The application enforces file type restrictions that an authenticated attacker can bypass by manipulating request attributes such as file extension, content type header, or magic bytes. Once the server accepts the crafted file, the attacker places executable server-side content inside the web root.

The payload is typically a webshell written in the server-side language used by AMSS++. Requesting the uploaded file from a browser or HTTP client triggers execution in the application context. From there, attackers execute operating system commands, pivot to internal systems, and stage additional tooling.

Root Cause

The root cause is improper validation of user-supplied files during upload. The application trusts client-controlled indicators rather than performing server-side content inspection and enforcing a strict allow list of file types. This weakness aligns with [CWE-434] and is a recurring pattern in web applications that store uploads inside the web-accessible directory tree.

Attack Vector

Exploitation requires an authenticated session on AMSS++. The attacker submits a crafted multipart upload that evades the restriction logic, then requests the resulting file over HTTP to trigger execution. Because the attack is network-reachable and requires only low privileges, insider threats and compromised low-tier accounts are viable exploitation paths. The vulnerability mechanism is documented in the INCIBE Security Notice.

No verified public proof-of-concept code is currently available for CVE-2024-2599. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2024-2599

Indicators of Compromise

New or unexpected files with executable extensions inside AMSS++ upload directories
HTTP POST requests to upload endpoints followed by GET requests to newly created files
Web server processes spawning shell interpreters such as sh, bash, cmd.exe, or powershell.exe
Outbound connections from the AMSS++ host to unknown external IP addresses

Detection Strategies

Inspect upload directories for files whose extensions do not match the expected media types
Correlate authenticated upload events with subsequent process creation on the web server host
Alert on web server user accounts executing reconnaissance commands such as whoami, id, or net user
Deploy web application firewall (WAF) rules that flag double extensions, null bytes, and content-type mismatches on upload requests

Monitoring Recommendations

Forward AMSS++ application logs and web server access logs to a centralized analytics platform for retention and correlation
Baseline normal upload volume per user and alert on outliers
Monitor for child processes originating from the AMSS++ application user
Track file integrity changes in the web root and uploads directory in near real time

How to Mitigate CVE-2024-2599

Immediate Actions Required

Restrict access to the AMSS++ application to trusted networks until a patched version is applied
Audit existing user accounts and revoke unnecessary upload privileges
Review upload directories for unauthorized files and remove any confirmed webshells
Rotate credentials and session tokens for all AMSS++ users after remediation

Patch Information

No vendor patch URL is listed in the enriched CVE data. Operators of AMSS++ 4.31 should contact the vendor and review the INCIBE Security Notice for the current fixed release and upgrade guidance.

Workarounds

Enforce server-side validation that inspects file magic bytes and rejects unknown types
Store uploads outside the web root and serve them through a handler that sets non-executable content types
Configure the web server to disable script execution in upload directories
Require multi-factor authentication (MFA) for accounts with upload permissions to raise the bar on authenticated exploitation

bash

# Example web server configuration to disable script execution in uploads (Apache)
<Directory "/var/www/amssplus/uploads">
    Options -ExecCGI
    RemoveHandler .php .phtml .phar .cgi .pl .py
    AddType text/plain .php .phtml .phar
    php_flag engine off
</Directory>