CVE-2024-44849: Qualitor RCE Vulnerability via File Upload

CVE-2024-44849 Overview

CVE-2024-44849 is a critical Remote Code Execution (RCE) vulnerability affecting Qualitor versions up to 8.24. The vulnerability exists in the checkAcesso.php file, which fails to properly validate uploaded files, allowing attackers to upload and execute arbitrary malicious code on affected systems. This unrestricted file upload vulnerability (CWE-434) enables unauthenticated attackers to gain complete control over vulnerable Qualitor installations through network-based attacks.

Critical Impact

Unauthenticated attackers can achieve complete system compromise by uploading malicious files through the checkAcesso.php endpoint, potentially leading to data theft, lateral movement, and full infrastructure takeover.

Affected Products

• Qualitor 8.20
• Qualitor 8.24
• Qualitor versions prior to 8.24

Discovery Timeline

• September 9, 2024 - CVE-2024-44849 published to NVD
• July 1, 2025 - Last updated in NVD database

Technical Details for CVE-2024-44849

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a common web application security flaw where server-side code fails to properly validate or restrict the types of files that users can upload. In the case of CVE-2024-44849, the checkAcesso.php endpoint in Qualitor does not implement adequate file type validation, extension filtering, or content verification.

The exploitation of this vulnerability is straightforward and requires no authentication. An attacker can craft a malicious request to the vulnerable endpoint, uploading a web shell or other executable file. Once uploaded, the attacker can access the malicious file through the web server, achieving arbitrary code execution within the context of the web application's server process.

The network-based attack vector with no required privileges or user interaction makes this vulnerability particularly dangerous for internet-exposed Qualitor installations.

Root Cause

The root cause of CVE-2024-44849 lies in insufficient input validation within the checkAcesso.php file. The endpoint accepts file uploads without properly verifying file types, checking file extensions against an allowlist, or validating file content. This allows attackers to bypass any intended restrictions and upload executable files such as PHP web shells that the server will subsequently execute.

Attack Vector

The attack leverages the network-accessible checkAcesso.php endpoint to upload malicious files. An attacker sends a specially crafted HTTP POST request containing a malicious payload disguised as a legitimate file or with a dangerous file extension (such as .php). The server processes the upload without adequate validation, stores the file in a web-accessible location, and the attacker can then execute the uploaded code by directly requesting the uploaded file through the web server.

The vulnerability requires no authentication and no user interaction, allowing fully automated exploitation. Technical details and proof-of-concept information are available in the GitHub Repository for CVE-2024-44849 and the Extencil Blog CVE Analysis.

Detection Methods for CVE-2024-44849

Indicators of Compromise

• Unusual HTTP POST requests to /checkAcesso.php containing file upload data
• Newly created PHP files or other executable files in web-accessible directories
• Web server access logs showing requests to recently uploaded files with suspicious names
• Outbound network connections from web server processes to unknown external hosts
• Evidence of web shell activity such as command execution or file system enumeration

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block suspicious file upload attempts targeting checkAcesso.php
• Monitor web server access logs for POST requests to the vulnerable endpoint followed by GET requests to newly created files
• Deploy file integrity monitoring (FIM) on web-accessible directories to detect unauthorized file creation
• Utilize endpoint detection and response (EDR) solutions to identify web shell behavior and suspicious process spawning from web server processes

Monitoring Recommendations

• Configure alerting for any file creation events in Qualitor's web directories, especially files with executable extensions
• Establish baseline network traffic patterns and alert on anomalous outbound connections from web server processes
• Monitor authentication logs for any suspicious administrative access following potential exploitation attempts
• Review web server error logs for indicators of failed exploitation attempts or malformed upload requests

How to Mitigate CVE-2024-44849

Immediate Actions Required

• Immediately restrict or disable network access to the checkAcesso.php endpoint if not business-critical
• Review web-accessible directories for any suspicious or recently uploaded files and remove unauthorized content
• Implement network-level access controls to limit who can reach Qualitor installations
• Apply vendor patches or upgrade to a patched version of Qualitor as soon as available

Patch Information

Qualitor has released security information regarding this vulnerability. Organizations should consult the Qualitor Security Advisory for official patch information and upgrade instructions. Apply the vendor-provided security updates as the primary remediation measure.

Workarounds

• Block access to checkAcesso.php at the web server or reverse proxy level using URL filtering rules
• Implement strict file upload validation at the web application firewall level, blocking uploads of executable file types
• Restrict network access to Qualitor instances using firewall rules, allowing only trusted IP ranges
• Deploy an application-layer proxy to inspect and filter malicious upload attempts before they reach the application

# Example: Apache configuration to block access to vulnerable endpoint
<Location /checkAcesso.php>
    Require all denied
</Location>

# Example: Nginx configuration to block access
location = /checkAcesso.php {
    deny all;
    return 403;
}