CVE-2024-42523 Overview
CVE-2024-42523 is an arbitrary file upload vulnerability affecting PublicCMS V4.0.202302.e and earlier versions. The flaw resides in the publiccms/admin/cmsTemplate/saveMetaData endpoint, which fails to properly validate uploaded file content and extensions. Authenticated administrators can abuse this endpoint to write arbitrary files to the server, including executable template files. Successful exploitation leads to server compromise through code execution within the CMS context. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.
Critical Impact
Authenticated attackers can upload malicious files through the template metadata endpoint, achieving arbitrary code execution and full compromise of the PublicCMS host.
Affected Products
- PublicCMS V4.0.202302.e
- All PublicCMS releases prior to V4.0.202302.e
- Deployments exposing the publiccms/admin/cmsTemplate/saveMetaData endpoint
Discovery Timeline
- 2024-08-23 - CVE-2024-42523 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-42523
Vulnerability Analysis
PublicCMS is a Java-based content management system developed by the sanluan project. The saveMetaData action inside the cmsTemplate administrative controller accepts template metadata and file content from an authenticated user. The handler writes the supplied data to disk without enforcing an allow-list of safe file types or sanitizing the target path. Attackers with administrator credentials can therefore save template files containing server-side script logic.
Because PublicCMS renders templates through its FreeMarker engine, attacker-controlled templates execute within the application. This transforms a file write primitive into arbitrary code execution. The vulnerability requires high privileges but does not require user interaction and is reachable over the network.
Root Cause
The root cause is missing validation in the template metadata save routine. The endpoint trusts the file name, extension, and content submitted by the caller. There is no verification that the destination stays within an intended template directory, and no restriction on server-executable content types. This matches the [CWE-434] pattern of unrestricted file upload of dangerous types.
Attack Vector
An attacker first obtains administrative access to the PublicCMS console, either through compromised credentials, credential reuse, or exploitation of a separate authentication weakness. The attacker then sends a crafted HTTP POST request to publiccms/admin/cmsTemplate/saveMetaData containing template content with embedded FreeMarker directives or a payload written to a web-accessible directory. Requesting the resulting template through the front-end triggers execution of attacker-supplied logic on the server.
A public proof-of-concept describing the request format is referenced in the GitHub Gist PoC Repository and the Gitee PublicCMS Issue Tracking entry.
Detection Methods for CVE-2024-42523
Indicators of Compromise
- HTTP POST requests to publiccms/admin/cmsTemplate/saveMetaData originating from unexpected source IPs or administrator accounts.
- Unexpected files with executable extensions such as .html, .ftl, .jsp, or .jspx appearing under the PublicCMS template directory.
- Modifications to template metadata timestamps that do not correspond to legitimate content-authoring activity.
- Outbound network connections initiated by the PublicCMS Java process following template writes.
Detection Strategies
- Inspect web server and application logs for saveMetaData invocations and correlate with the authenticated administrator session.
- Alert on newly created or modified files within the PublicCMS webroot and template directories using file integrity monitoring.
- Baseline administrator activity and flag template writes performed outside of business hours or from atypical geolocations.
Monitoring Recommendations
- Forward web access logs, application logs, and file system audit events into a centralized SIEM for correlation.
- Monitor the PublicCMS Java process for spawning shell interpreters such as sh, bash, or cmd.exe.
- Track authentication events for the administrator role and alert on new admin account creation.
How to Mitigate CVE-2024-42523
Immediate Actions Required
- Upgrade PublicCMS to a release later than V4.0.202302.e that addresses the saveMetaData validation gap.
- Restrict network access to the /admin/ path so that only trusted administrative networks can reach it.
- Rotate all PublicCMS administrator credentials and enforce strong, unique passwords.
- Review template directories for unauthorized files and remove any that cannot be tied to legitimate change management.
Patch Information
No formal vendor advisory URL is published in NVD. Track upstream fixes and issue status through the Gitee PublicCMS Issue Tracking page and apply the most recent PublicCMS release available from the project maintainers.
Workarounds
- Place the PublicCMS admin interface behind a VPN or IP allow-list until a patched version is deployed.
- Configure the reverse proxy to block requests to publiccms/admin/cmsTemplate/saveMetaData from untrusted networks.
- Enforce multi-factor authentication on administrator accounts to reduce the likelihood of credential-based access.
- Run the PublicCMS process under a low-privilege service account and restrict write permissions on the template directory where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
