CVE-2024-33438: CubeCart File Upload RCE Vulnerability

CVE-2024-33438 Overview

CVE-2024-33438 is an unrestricted file upload vulnerability [CWE-434] affecting CubeCart versions prior to 6.5.5. The e-commerce platform's file manager fails to block .phar extensions, allowing an authenticated user to upload a crafted PHP archive file and execute arbitrary code on the server.

Because PHP interprets .phar files as executable code, an attacker with valid credentials can achieve remote code execution in the context of the web server. The flaw was patched in CubeCart 6.5.5 by adding .phar to the illegal filename blocklist.

Critical Impact
Authenticated attackers can upload a .phar file through the CubeCart file manager and execute arbitrary PHP code, leading to full compromise of the storefront and underlying host.

Affected Products

CubeCart versions before 6.5.5
CubeCart v6 branch (all releases prior to the 31a5ec3 commit)
Deployments exposing the administrative file manager to authenticated users

Discovery Timeline

2024-04-29 - CVE-2024-33438 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33438

Vulnerability Analysis

The vulnerability resides in the filenameIsIllegal() method inside classes/filemanager.class.php. This function enforces the extension blocklist that the file manager uses to reject dangerous uploads. The original regular expression matched .php, .phtml, .php3–.php6, .htaccess, and .sh.inc.ini, but omitted .phar.

PHP treats .phar (PHP Archive) files as executable when the web server is configured to hand them to the PHP interpreter, which is the default on many Apache and Nginx deployments. An authenticated user with access to the file manager can upload a .phar payload, request it via HTTP, and execute arbitrary PHP under the web server account.

Exploitation requires authentication and user interaction, but the network attack vector and the resulting code execution mean successful abuse compromises the application, its database credentials, and any data reachable from the host.

Root Cause

The root cause is an incomplete deny list in server-side upload validation. CubeCart relied on extension matching alone and did not enumerate every PHP-executable suffix, leaving .phar as a bypass path for the same class of attack the filter was meant to prevent.

Attack Vector

An attacker authenticates to CubeCart with a low-privilege account that has file manager access, uploads a crafted .phar file containing PHP code, then triggers execution by requesting the file's URL. The payload runs with the privileges of the PHP process.

php

 public function filenameIsIllegal($file_name)
 {
-        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phtml|\.php[3-6])$/i', $file_name)) {
+        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phar|\.phtml|\.php[3-6])$/i', $file_name)) {
             return true;
         } elseif (preg_match('/\.php\./i', $file_name)) {
             return true;

The patch adds \.phar to the illegal extension regex, causing the file manager to reject uploads whose names end in .phar. Source: CubeCart v6 commit 31a5ec3

Detection Methods for CVE-2024-33438

Indicators of Compromise

Presence of .phar files under CubeCart web-writable directories such as images/source/ or other file manager upload paths
HTTP requests to URLs ending in .phar in Apache, Nginx, or CDN access logs
New administrative or file manager sessions from unexpected IP addresses immediately before a .phar file appears on disk
PHP-FPM or Apache worker processes spawning shells (sh, bash, nc) or outbound network connections initiated from the CubeCart docroot

Detection Strategies

Hunt file system telemetry for creation of *.phar files under any web-accessible CubeCart directory and correlate with the authenticated user session that produced them
Alert on web access logs whenever a client requests a .phar resource, since legitimate CubeCart traffic does not include PHP archives
Compare deployed CubeCart source against the 6.5.5 release to identify installations still missing .phar in the filenameIsIllegal() blocklist

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the CubeCart webroot and forward changes to a centralized log platform for correlation
Capture and retain audit logs from the CubeCart administrative interface, including file manager upload events and the associated user identity
Monitor PHP process behavior for unexpected child processes, outbound connections, and writes to sensitive configuration files

How to Mitigate CVE-2024-33438

Immediate Actions Required

Upgrade CubeCart to version 6.5.5 or later, which adds .phar to the file manager's illegal filename filter
Audit the webroot for existing .phar files and remove any that were not placed by an authorized administrator
Review CubeCart user accounts and revoke file manager permissions from any user that does not require them
Rotate administrative credentials, database passwords, and API tokens if evidence of exploitation is found

Patch Information

The fix is delivered in CubeCart 6.5.5, tracked in commit 31a5ec39b0924b2111fbc3aa419bd8c5c3fc1841. See the CubeCart 6.5.5 security update announcement and the upstream commit in the CubeCart v6 repository for full details.

Workarounds

Configure the web server to refuse execution of .phar files inside user-writable directories using an Apache <FilesMatch> block or an equivalent Nginx location rule
Deploy a web application firewall (WAF) rule that blocks HTTP requests containing .phar in the upload filename or the request URI
Restrict access to the CubeCart admin panel and file manager by IP allowlist until the patched release is deployed

bash

# Apache: deny execution and access to .phar files in the CubeCart webroot
<FilesMatch "\.phar$">
    Require all denied
    SetHandler none
</FilesMatch>

# Nginx equivalent
location ~* \.phar$ {
    deny all;
    return 403;
}