CVE-2024-36598: Aegon Life v1.0 RCE Vulnerability

CVE-2024-36598 Overview

CVE-2024-36598 is an arbitrary file upload vulnerability affecting Aegon Life v1.0, a life insurance management system published by projectworlds.in. The flaw allows an authenticated attacker to upload a crafted image file that bypasses server-side validation and results in arbitrary code execution on the hosting server.

The issue is classified under [CWE-94] Improper Control of Generation of Code. A public proof-of-concept exists on GitHub, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the web server, enabling full compromise of the application, its data, and any connected backend resources.

Affected Products

Aegon Life v1.0 Life Insurance Management System
Deployments distributed via projectworlds.in
Web applications reusing the vulnerable upload handler

Discovery Timeline

2024-06-14 - CVE-2024-36598 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36598

Vulnerability Analysis

The vulnerability resides in an image upload feature of the Aegon Life v1.0 application. The upload handler accepts files based on client-supplied metadata rather than validating file content, structure, or executable properties on the server side.

An attacker with low-privileged access can submit a file crafted to appear as an image while containing server-side script content. When the file is written to a web-accessible directory and later requested, the server interprets and executes the embedded code.

Because the application does not restrict executable file extensions or sanitize uploaded content, the flaw enables full remote code execution over the network. The confidentiality and integrity of the application are directly impacted, and lateral movement into backing databases is feasible.

Root Cause

The root cause is missing enforcement of file type, extension, and content validation on the upload endpoint. The handler trusts attacker-controlled metadata such as Content-Type headers and file extensions, and it stores uploads in a directory where the web server executes scripts.

Attack Vector

Exploitation requires network access to the application and low-privilege authentication. The attacker submits a POST request to the vulnerable upload endpoint with a polyglot or double-extension file, for example shell.php.jpg, containing server-side script code. After upload, the attacker requests the stored file directly, triggering code execution under the web server account. Refer to the GitHub PoC for CVE-2024-36598 for technical details.

Detection Methods for CVE-2024-36598

Indicators of Compromise

Presence of files with double extensions such as .php.jpg, .phtml.png, or .asp.gif inside upload directories.
Uploaded image files whose byte content includes PHP tags (<?php) or other server-side scripting markers.
Web server access logs showing GET requests to files inside upload paths returning dynamic content or non-image responses.
Outbound network connections initiated from the web server process shortly after an upload event.

Detection Strategies

Scan the application's upload directory for files whose extension does not match their actual MIME signature.
Alert on web requests where uploaded artifacts under image paths are served with Content-Type: text/html or application/x-httpd-php.
Correlate authenticated upload actions with subsequent process creation events on the hosting server.

Monitoring Recommendations

Enable file integrity monitoring on the Aegon Life webroot and upload directories.
Forward web server access and error logs to a central analytics platform for anomaly detection on POST-to-GET upload sequences.
Monitor for unexpected child processes spawned by the PHP or web server user, such as sh, bash, cmd.exe, or powershell.exe.

How to Mitigate CVE-2024-36598

Immediate Actions Required

Restrict access to the Aegon Life application to trusted networks until a vendor patch is available.
Disable the image upload feature or place it behind stricter authentication and authorization checks.
Audit the upload directory for suspicious files and remove any confirmed webshells.
Rotate credentials and session tokens for any account with access to the upload functionality.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2024-36598 at the time of publication. Operators of Aegon Life v1.0 should monitor projectworlds.in for updates and consider replacing the vulnerable component with a validated upload library.

Workarounds

Configure the web server to disable script execution inside upload directories, for example via php_admin_flag engine off in Apache or a location block denying PHP in Nginx.
Enforce server-side validation of uploaded files using MIME sniffing and magic-byte checks, rejecting anything not matching an allowlist of image formats.
Rename uploaded files to random identifiers and strip original extensions before storing them.
Deploy a web application firewall rule that blocks uploads containing script tags or PHP markers in image payloads.

bash

# Apache configuration example: disable script execution in the upload directory
<Directory "/var/www/aegonlife/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .php5 .phar
    Options -ExecCGI
    <FilesMatch "\.(php|phtml|php5|phar|pl|py|jsp|asp|sh|cgi)$">
        Require all denied
    </FilesMatch>
</Directory>