CVE-2024-47051: Acquia Mautic RCE Vulnerability

CVE-2024-47051 Overview

CVE-2024-47051 covers two security vulnerabilities in Mautic marketing automation software before version 5.2.3. The first is a Remote Code Execution (RCE) flaw in the asset upload functionality. Insufficient validation of allowed file extensions lets authenticated attackers upload executable files such as PHP scripts. The second is a Path Traversal flaw [CWE-23] in the upload validation process. Improper handling of path components enables authenticated users to delete arbitrary files on the host system. Both issues require authenticated access but enable complete compromise of the Mautic instance and underlying server.

Critical Impact

An authenticated attacker can achieve remote code execution on the host and delete arbitrary files, leading to full server compromise and data loss.

Affected Products

• Acquia Mautic versions before 5.2.3
• Mautic open source marketing automation platform
• Any deployment exposing authenticated asset upload functionality

Discovery Timeline

• 2025-02-26 - CVE-2024-47051 published to the National Vulnerability Database
• 2025-10-16 - Last updated in NVD database

Technical Details for CVE-2024-47051

Vulnerability Analysis

The advisory describes two distinct weaknesses chained under a single CVE. The RCE vector resides in Mautic's asset upload feature, which validates file extensions through an incomplete deny-list. Attackers can submit filenames or content types that bypass the extension check, placing executable PHP files into a web-accessible directory. Once uploaded, requesting the file triggers server-side execution under the web server account.

The second weakness is a path traversal in the upload validation routine. The application does not normalize path components such as ../ sequences before performing file operations. An authenticated user can craft an upload request that references files outside the intended upload directory, causing the deletion logic to remove arbitrary files. Deleting configuration files, session stores, or application source files produces denial-of-service conditions and can assist further exploitation.

Both flaws require valid credentials but only standard user privileges, which makes credential theft or weak account compromise a viable entry point. The scope changes once code executes under the web server context, granting access to database credentials, customer marketing data, and adjacent services.

Root Cause

The RCE stems from improper enforcement of allowed file extensions during asset upload. The path traversal stems from missing canonicalization and validation of user-supplied path components before file deletion operations, classified as CWE-23 Relative Path Traversal.

Attack Vector

Exploitation requires network access to the Mautic web interface and valid authenticated credentials. An attacker logs in, navigates to the asset upload feature, and submits a crafted file whose extension or MIME handling bypasses the validation routine. After upload, the attacker requests the resulting URL to execute server-side code. For the deletion variant, the attacker submits an upload request with a manipulated path parameter to remove files outside the asset directory. Refer to the Mautic GitHub Security Advisory for technical specifics.

Detection Methods for CVE-2024-47051

Indicators of Compromise

• New or unexpected .php, .phtml, or .phar files within Mautic's media/files/ or media/assets/ directories.
• Web server access logs showing POST requests to asset upload endpoints followed by GET requests to uploaded files with executable extensions.
• Unexpected outbound network connections originating from the PHP-FPM or Apache worker process hosting Mautic.
• Missing or recently deleted core application files, configuration files, or log entries indicating file removal operations from authenticated sessions.

Detection Strategies

• Monitor file system events in Mautic upload directories for creation of files with server-executable extensions.
• Inspect HTTP request bodies for upload parameters containing ../ sequences or absolute paths.
• Correlate authenticated Mautic session activity with web shell-like response patterns such as short request-response intervals returning command output.

Monitoring Recommendations

• Enable verbose application logging in Mautic and forward logs to a centralized SIEM for correlation with web server and host telemetry.
• Alert on process creation events where the web server user spawns shells, curl, wget, or scripting interpreters.
• Baseline expected files in Mautic content directories and alert on deviations.

How to Mitigate CVE-2024-47051

Immediate Actions Required

• Upgrade Mautic to version 5.2.3 or later as the primary remediation.
• Audit Mautic user accounts and rotate credentials, removing inactive or unnecessary accounts that could be used for authenticated exploitation.
• Review asset upload directories for unauthorized files and inspect application files for unexpected deletions or modifications.
• Restrict network access to the Mautic administration interface using IP allow-lists or VPN-only access.

Patch Information

The Mautic project addressed both vulnerabilities in version 5.2.3. Patch details and remediation guidance are published in the Mautic GHSA-73gx-x7r9-77x2 advisory. Acquia Mautic customers should apply the corresponding update through their managed channel.

Workarounds

• Configure the web server to deny execution of PHP and other interpreter files within Mautic upload directories using directives such as php_flag engine off or equivalent Nginx location blocks.
• Apply strict file system permissions so the web server account cannot write to directories outside designated upload paths.
• Place the Mautic instance behind a web application firewall with rules that block path traversal sequences and disallowed file extensions in multipart upload requests.

# Apache: disable PHP execution in Mautic upload directories
<Directory "/var/www/mautic/media/files">
    php_flag engine off
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    Options -ExecCGI
</Directory>