CVE-2024-34833: Payroll Management System RCE Vulnerability

CVE-2024-34833 Overview

CVE-2024-34833 is an unrestricted file upload vulnerability affecting Sourcecodester Payroll Management System v1.0. The application allows users to upload images via the save_settings page but fails to properly validate uploaded file types. An unauthenticated attacker can exploit this weakness to upload a malicious PHP file instead of a legitimate image. Successful exploitation results in arbitrary code execution with the privileges of the web server user, potentially leading to complete system compromise.

Critical Impact

Unauthenticated remote code execution allows attackers to gain full control of affected web servers, potentially compromising sensitive payroll data and pivoting to internal network resources.

Affected Products

• Sourcecodester Payroll Management System v1.0
• oretnom23 payroll_management_system 1.0

Discovery Timeline

• 2024-06-17 - CVE-2024-34833 published to NVD
• 2025-04-30 - Last updated in NVD database

Technical Details for CVE-2024-34833

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The save_settings functionality in Sourcecodester Payroll Management System v1.0 is designed to allow administrators to upload image files for customization purposes. However, the application fails to implement proper server-side validation of uploaded file types, relying potentially only on client-side controls or file extension checks that can be easily bypassed.

The lack of authentication requirements for accessing this upload functionality compounds the severity of the issue. An unauthenticated attacker can directly access the vulnerable endpoint and upload arbitrary files, including PHP web shells. Once uploaded, these malicious files can be accessed via the web server to execute arbitrary commands on the underlying system.

Root Cause

The root cause of this vulnerability lies in insufficient input validation on the server-side file upload handling. The application does not properly verify:

1. File type validation - The application fails to check the actual MIME type or file content (magic bytes) of uploaded files
2. File extension restrictions - Server-side enforcement of allowed file extensions is either missing or improperly implemented
3. Authentication requirements - The save_settings endpoint lacks proper authentication checks, allowing unauthenticated access
4. Upload directory configuration - Uploaded files are stored in a web-accessible directory where PHP files can be executed

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker can craft a malicious HTTP POST request to the save_settings endpoint containing a PHP web shell disguised with image-related metadata or simply uploaded directly as a .php file. The attack sequence involves:

1. Identifying the vulnerable save_settings endpoint on the target application
2. Crafting a malicious PHP payload (web shell) for upload
3. Submitting the payload via an HTTP POST request to the vulnerable endpoint
4. Locating the uploaded file in the web-accessible uploads directory
5. Executing arbitrary commands by accessing the uploaded PHP file through the web browser

Technical details and proof-of-concept code are available in the GitHub PoC Repository and Packet Storm Security.

Detection Methods for CVE-2024-34833

Indicators of Compromise

• Unexpected PHP files appearing in upload directories (e.g., uploads/, images/, or similar web-accessible folders)
• HTTP POST requests to /save_settings from unauthenticated sources or external IP addresses
• Web server logs showing access to suspicious PHP files in upload directories
• Unusual process spawning from web server processes (e.g., www-data or apache user executing shell commands)

Detection Strategies

• Monitor web server access logs for POST requests to save_settings endpoints from unauthenticated sessions
• Implement file integrity monitoring on web application directories to detect unauthorized PHP file creation
• Deploy web application firewalls (WAF) with rules to detect PHP content in file upload requests
• Use endpoint detection and response (EDR) solutions to monitor for command execution originating from web server processes

Monitoring Recommendations

• Enable verbose logging on web application upload functionality and review logs regularly
• Configure alerting for any PHP file creation in designated upload directories
• Monitor outbound network connections from the web server for potential command and control traffic
• Implement real-time file scanning on upload directories to detect web shells and malicious scripts

How to Mitigate CVE-2024-34833

Immediate Actions Required

• Restrict or disable access to the save_settings functionality until a patch is available
• Implement authentication requirements for all administrative functions including file uploads
• Remove or quarantine the Sourcecodester Payroll Management System if actively exposed to the internet
• Audit upload directories for any suspicious PHP files and remove unauthorized content

Patch Information

No official vendor patch has been released for this vulnerability. Sourcecodester applications are community-developed projects, and users should evaluate whether continued use is appropriate for their security requirements. Consider migrating to a more actively maintained payroll management solution with proper security controls.

Workarounds

• Implement server-side file type validation using magic byte checking rather than relying on file extensions
• Configure the web server to prevent PHP execution in upload directories using .htaccess or server configuration directives
• Add authentication requirements to the save_settings endpoint via application code modifications or web server access controls
• Deploy a web application firewall (WAF) to filter malicious file upload attempts

# Apache configuration to disable PHP execution in uploads directory
# Add to .htaccess in the uploads directory or Apache configuration
<Directory "/var/www/html/payroll/uploads">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php3 .php4 .php5 .php7 .phps
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps
</Directory>

# Nginx configuration to disable PHP execution
# Add to server block for the affected application
location ~* /uploads/.*\.php$ {
    deny all;
    return 403;
}