CVE-2024-47655: Shilpisoft Client Dashboard RCE Vulnerability

CVE-2024-47655 Overview

CVE-2024-47655 is an unrestricted file upload vulnerability affecting the Shilpisoft Client Dashboard. The application fails to validate file extensions properly during upload operations. An authenticated remote attacker can upload arbitrary files, including server-side scripts, that execute within the web application context. Successful exploitation grants remote code execution on the target host.

The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. CERT-In issued advisory CIVN-2024-0313 covering this defect.

Critical Impact
Authenticated attackers can achieve remote code execution by uploading malicious files that bypass extension validation, compromising confidentiality and integrity of the Client Dashboard application.

Affected Products

Shilpisoft Client Dashboard (all versions prior to the vendor fix)
Deployments exposing the file upload functionality to authenticated users
Web servers hosting the vulnerable client_dashboard application component

Discovery Timeline

2024-10-04 - CVE-2024-47655 published to the National Vulnerability Database
2024-10-04 - CERT-In publishes advisory CIVN-2024-0313
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-47655

Vulnerability Analysis

The Shilpi Client Dashboard exposes a file upload endpoint that trusts client-supplied file metadata. The application checks the declared extension but does not validate the actual file content, MIME type, or verify that the extension matches an allow-list of safe values. An authenticated attacker can therefore submit a file with executable server-side content and a permitted extension, or bypass extension checks entirely.

Once written to a web-accessible directory, the uploaded file can be requested over HTTP. The web server executes the malicious payload, providing the attacker with code execution under the privileges of the application process. This grants read access to application data, database credentials, and any secrets available to the service account.

Root Cause

The root cause is improper input validation on the file upload handler [CWE-434]. The dashboard relies on a superficial extension check rather than content inspection, magic-byte verification, or storage outside the web root. This design allows dangerous file types to reach an execution-capable location.

Attack Vector

Exploitation requires network access to the dashboard and valid authenticated credentials with upload privileges. No user interaction is required. The attacker submits a crafted multipart upload request, then navigates to the uploaded resource to trigger execution. Because the attack originates over the network with low complexity, exposed instances face elevated risk from insider threats and credential-compromise scenarios.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the CERT-In Advisory CIVN-2024-0313 for vendor-coordinated technical details.

Detection Methods for CVE-2024-47655

Indicators of Compromise

Unexpected files with server-executable extensions (.php, .jsp, .aspx) in upload directories used by the Client Dashboard.
Web server access logs showing POST requests to upload endpoints followed by GET requests to newly created files.
Outbound network connections initiated by the web application process to unfamiliar hosts after file upload activity.
New or modified files in upload directories owned by the web server user outside routine business hours.

Detection Strategies

Compare file upload directory contents against a known-good baseline and alert on deviations.
Deploy web application firewall rules that inspect uploaded file content and block executable payloads regardless of declared extension.
Correlate authentication events with upload activity to identify anomalous user behavior.

Monitoring Recommendations

Monitor process-creation events spawned by the web server, particularly shells and interpreter processes with unusual parent-child relationships.
Log and review all HTTP requests targeting upload endpoints, including source IP, authenticated user, and resulting file path.
Track file integrity across the dashboard web root and alert on writes from the application user account.

How to Mitigate CVE-2024-47655

Immediate Actions Required

Apply the vendor patch referenced in CERT-In Advisory CIVN-2024-0313 as soon as it is available for your deployment.
Restrict access to the Client Dashboard to trusted networks using firewall or VPN controls.
Audit existing upload directories for suspicious files and remove any unauthorized artifacts.
Rotate credentials for accounts with upload privileges on the dashboard.

Patch Information

Shilpisoft has coordinated remediation through CERT-In. Administrators should contact the vendor directly to obtain the fixed release and confirm the version number that addresses CVE-2024-47655. No vendor advisory URL was published in the NVD record beyond the CERT-In reference.

Workarounds

Configure the web server to deny script execution within upload directories using directives such as php_flag engine off for Apache or a location-scoped handler override in Nginx.
Enforce an allow-list of file extensions and validate uploaded content using magic-byte inspection before persisting files.
Store uploaded files outside the web root and serve them through a controlled handler that sets Content-Disposition: attachment.
Reduce the privileges of the web application service account so that a successful upload cannot pivot to broader system compromise.

bash

# Example: disable PHP execution in an Apache upload directory
<Directory "/var/www/client_dashboard/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .php5 .phar
    Options -ExecCGI
    RemoveHandler .php .phtml .php5
</Directory>