CVE-2024-42640: angular-base64-upload RCE Vulnerability

CVE-2024-42640 Overview

CVE-2024-42640 is an unauthenticated remote code execution (RCE) vulnerability affecting angular-base64-upload prior to version v0.1.21. The vulnerability exists in the demo/server.php file, which allows attackers to upload arbitrary content to the server without authentication. Uploaded malicious files can subsequently be accessed and executed through the demo/uploads directory, enabling full code execution on the vulnerable server.

Critical Impact

Unauthenticated attackers can achieve remote code execution by uploading and executing arbitrary files, potentially leading to complete server compromise. This vulnerability affects an end-of-life product no longer supported by the maintainer.

Affected Products

• angular-base64-upload versions prior to v0.1.21
• Applications using the vulnerable demo/server.php component
• Deployments with exposed demo/ directory accessible via web

Discovery Timeline

• 2024-10-11 - CVE-2024-42640 published to NVD
• 2024-10-15 - Last updated in NVD database

Technical Details for CVE-2024-42640

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The demo/server.php file in angular-base64-upload lacks proper authentication and input validation, allowing any unauthenticated user to upload arbitrary files to the server. The uploaded files are stored in the demo/uploads directory and can be accessed directly, enabling attackers to upload and execute malicious scripts such as PHP web shells.

The attack requires no authentication, no user interaction, and can be executed remotely over the network. The impact is severe as successful exploitation grants the attacker complete control over the web server, including the ability to read sensitive data, modify system configurations, and pivot to other systems on the network.

It is important to note that this vulnerability affects a product that is no longer maintained by its developer, meaning no official patch or security updates will be provided.

Root Cause

The root cause of this vulnerability is the absence of authentication and file type validation in the demo/server.php upload handler. The demonstration code was likely intended for development purposes only but was included in production deployments. The script accepts file uploads without verifying the user's identity or restricting the types of files that can be uploaded, allowing dangerous file types such as PHP scripts to be stored and executed.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending a crafted HTTP request to demo/server.php with malicious file content (e.g., a PHP web shell)
2. The server stores the uploaded file in the demo/uploads directory without validation
3. The attacker accesses the uploaded file directly via demo/uploads/<filename>
4. The web server executes the malicious code, granting the attacker remote command execution capabilities

The vulnerability mechanism involves unrestricted file upload functionality in the demo server component. For detailed technical analysis and exploitation techniques, refer to the Zyenra security blog post.

Detection Methods for CVE-2024-42640

Indicators of Compromise

• Unexpected files appearing in the demo/uploads directory, particularly PHP files or files with executable extensions
• HTTP POST requests to demo/server.php from unknown or suspicious IP addresses
• Web shell signatures or suspicious PHP code in uploaded files
• Unusual outbound network connections from the web server

Detection Strategies

• Monitor web server access logs for requests targeting demo/server.php and demo/uploads/ paths
• Implement file integrity monitoring on web application directories to detect unauthorized file additions
• Deploy web application firewalls (WAF) with rules to block file upload attacks and web shell patterns
• Use endpoint detection and response (EDR) solutions to identify post-exploitation activities

Monitoring Recommendations

• Enable verbose logging for web server file upload handlers and PHP script execution
• Configure alerts for new file creation events in the demo/ directory structure
• Monitor for PHP process spawning suspicious child processes (e.g., cmd.exe, bash, sh)
• Implement network monitoring to detect command and control traffic patterns

How to Mitigate CVE-2024-42640

Immediate Actions Required

• Remove or restrict access to the demo/ directory from production web servers immediately
• Audit existing installations for the presence of demo/server.php and remove if found
• Review the demo/uploads/ directory for any suspicious or unauthorized files
• Implement web server configuration to block access to demo directories (e.g., via .htaccess or server configuration)

Patch Information

This vulnerability affects a product that is no longer supported by the maintainer. Upgrading to version v0.1.21 or later addresses this vulnerability; however, given the end-of-life status, organizations should consider migrating to actively maintained alternatives. For reference, the angular-base64-upload GitHub repository contains the source code and version history.

Workarounds

• Delete the entire demo/ directory from production deployments as it is not required for normal operation
• Configure web server access controls to deny requests to demo/server.php and demo/uploads/
• Implement network-level restrictions to limit access to the application from trusted IP addresses only
• Deploy a web application firewall with rules to block file upload attacks and restrict access to sensitive paths

# Apache configuration to block access to demo directory
<Directory "/var/www/html/demo">
    Require all denied
</Directory>

# Nginx configuration to block access to demo directory
location /demo {
    deny all;
    return 403;
}