CVE-2024-27115: Soplanning RCE Vulnerability Explained

CVE-2024-27115 Overview

CVE-2024-27115 is a critical unauthenticated Remote Code Execution (RCE) vulnerability discovered in SO Planning, an online planning and scheduling tool. This vulnerability allows attackers to upload executable files that are moved to a publicly accessible folder before any verification requirements are checked. This improper file upload handling leads to the possibility of arbitrary code execution on the underlying system when the malicious file is triggered.

Critical Impact

Unauthenticated attackers can achieve full system compromise by uploading and executing malicious files on servers running vulnerable versions of SO Planning, potentially leading to complete infrastructure takeover.

Affected Products

• SO Planning versions prior to 1.52.02
• All installations with default file upload configurations
• Self-hosted SO Planning deployments exposed to the internet

Discovery Timeline

• 2024-09-11 - CVE CVE-2024-27115 published to NVD
• 2024-09-18 - Last updated in NVD database

Technical Details for CVE-2024-27115

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which represents a critical class of web application security flaws. The core issue lies in SO Planning's file upload mechanism, which fails to properly validate uploaded files before placing them in a web-accessible directory.

The attack requires no authentication, meaning any network-connected adversary can exploit this vulnerability without credentials. The file upload functionality moves uploaded content to a publicly accessible location on the server before performing any security checks or file type verification, creating a race condition that attackers can leverage for immediate code execution.

Root Cause

The root cause of CVE-2024-27115 stems from improper ordering of security operations in the file upload workflow. The application moves uploaded files to a publicly accessible directory before validating file types, extensions, or content. This "move-then-verify" approach creates a window where malicious executable files can be accessed and triggered by an attacker before any security controls are applied.

Attack Vector

The attack is network-accessible with low complexity and requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious executable file (such as a PHP web shell or server-side script)
2. Uploading the file through SO Planning's file upload functionality without authentication
3. Accessing the uploaded file directly via its publicly accessible URL before verification occurs
4. Achieving arbitrary code execution on the underlying server with the privileges of the web server process

This attack pattern enables complete server compromise, data exfiltration, lateral movement within the network, and establishment of persistent backdoor access.

Detection Methods for CVE-2024-27115

Indicators of Compromise

• Unexpected executable files (.php, .phtml, .phar, .sh, .py, .pl) appearing in SO Planning upload directories
• Web server logs showing requests to unusual file paths within the SO Planning application directory
• Anomalous outbound network connections originating from the web server process
• New or modified files with recent timestamps in publicly accessible upload folders

Detection Strategies

• Monitor file system events for creation of executable files in SO Planning upload directories
• Implement web application firewall (WAF) rules to inspect file upload requests for malicious content signatures
• Review web server access logs for requests to files with executable extensions in upload paths
• Deploy endpoint detection solutions to identify web shell behaviors and suspicious script execution

Monitoring Recommendations

• Enable detailed logging for file upload operations within SO Planning
• Configure alerts for executable file creation events on web servers hosting SO Planning
• Implement network monitoring for unusual command-and-control (C2) communication patterns from web servers
• Establish baseline behavior monitoring for the web server process to detect anomalous activity

How to Mitigate CVE-2024-27115

Immediate Actions Required

• Upgrade SO Planning to version 1.52.02 or later immediately
• Restrict network access to SO Planning instances using firewall rules until patching is complete
• Review upload directories for any suspicious or unauthorized files
• Implement additional WAF protections to block malicious file uploads as a defense-in-depth measure

Patch Information

The vulnerability has been remediated in SO Planning version 1.52.02. Organizations should upgrade to this version or later to address CVE-2024-27115. Additional technical details are available in the DIVD CVE-2024-27115 Analysis.

Workarounds

• Implement strict file type validation at the web server level using configuration directives
• Configure the web server to prevent execution of scripts in upload directories using .htaccess or equivalent configurations
• Place upload directories outside the web root or block direct access via web server configuration
• Deploy a reverse proxy with request filtering to inspect and sanitize file upload requests

# Apache configuration to disable script execution in upload directories
<Directory "/var/www/soplanning/uploads">
    # Disable PHP execution
    php_admin_flag engine Off
    
    # Deny access to executable file types
    <FilesMatch "\.(php|phtml|phar|php5|php7|sh|py|pl|cgi)$">
        Require all denied
    </FilesMatch>
    
    # Set restrictive content-type headers
    RemoveHandler .php .phtml .phar .php5 .php7
    RemoveType .php .phtml .phar .php5 .php7
</Directory>