CVE-2024-52302: Common User Management RCE Vulnerability

CVE-2024-52302 Overview

CVE-2024-52302 affects common-user-management, a Spring Boot application providing dynamic user access control services. The vulnerability resides in the /api/v1/customer/profile-picture endpoint, which accepts file uploads without validating file type or content. An authenticated attacker can upload malicious files, including executable payloads, to achieve Remote Code Execution (RCE) on the host. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the server, exposing confidentiality, integrity, and availability of the application and underlying system.

Affected Products

common-user-management Spring Boot application by OsamaTaher
Repository: Java-springboot-codebase
Versions prior to the fix in commit 204402b

Discovery Timeline

2024-11-14 - CVE-2024-52302 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52302

Vulnerability Analysis

The /api/v1/customer/profile-picture endpoint processes uploaded files without enforcing content-type verification or extension whitelisting. The application relies on client-supplied metadata, which attackers can trivially manipulate. By uploading a file containing executable code, such as a JSP or crafted image with embedded payload, an attacker can obtain code execution within the Spring Boot process context.

The issue falls under CWE-434, unrestricted file upload of dangerous types. Because the endpoint is network-reachable and only requires low-privileged authenticated access, the vulnerability is practical to exploit at scale in exposed deployments.

Root Cause

The FileSystemStorageService implementation validated uploads based on filename extension and client-supplied MIME type. Neither check inspects the actual binary content. The patch introduces org.apache.tika.Tika for server-side content-type detection, replacing the earlier reliance on the firebase-admin dependency for storage handling.

Attack Vector

An attacker authenticates to the application and issues a multipart HTTP POST to /api/v1/customer/profile-picture. The payload contains a malicious file disguised with an image extension. Once stored under the served directory, the attacker triggers the file through a subsequent request, executing arbitrary code under the application user.

java

// Patch: FileSystemStorageService.java (CVE-2024-52302)
import jakarta.annotation.PostConstruct;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.io.FilenameUtils;
import org.apache.tika.Tika;
import org.imgscalr.Scalr;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.io.Resource;
// Source: https://github.com/OsamaTaher/Java-springboot-codebase/commit/204402bb8b68030c14911379ddc82cfff00b8538

Detection Methods for CVE-2024-52302

Indicators of Compromise

Unexpected files with executable extensions (.jsp, .jspx, .sh, .war) in the profile-picture storage directory
HTTP POST requests to /api/v1/customer/profile-picture with non-image Content-Type or oversized payloads
Child processes spawned by the Spring Boot JVM that invoke shell interpreters or network utilities
Outbound connections from the application host to unfamiliar external endpoints shortly after upload activity

Detection Strategies

Inspect web access logs for uploads to the profile-picture endpoint followed by GET requests to the same stored asset paths
Correlate file-write events in the upload directory with subsequent process creation events from the JVM
Apply content-type verification at a reverse proxy or WAF, alerting when declared MIME types do not match actual magic bytes

Monitoring Recommendations

Monitor the file system location backing profile-picture for writes of non-image content
Track authentication events preceding upload attempts to identify credential abuse patterns
Alert on any Java process spawning bash, sh, cmd.exe, or powershell.exe children

How to Mitigate CVE-2024-52302

Immediate Actions Required

Update common-user-management to the version containing commit 204402b, which introduces Apache Tika content validation
Restrict the /api/v1/customer/profile-picture endpoint behind additional authentication or network controls until patched
Audit the upload storage directory for any unauthorized files and remove suspicious artifacts
Rotate credentials and secrets accessible to the application if compromise is suspected

Patch Information

The fix is committed at GitHub commit 204402b. The patch replaces the firebase-admin dependency with org.apache.tika:tika-core:2.8.0 and integrates Tika-based MIME detection into FileSystemStorageService. Full advisory details are available in the GitHub Security Advisory GHSA-rhcq-44g3-5xcx.

Workarounds

Deploy a reverse proxy or WAF rule that rejects uploads whose magic bytes do not match declared image MIME types
Configure the upload storage directory as non-executable and outside any servlet-mapped path
Enforce strict extension allowlists (.jpg, .jpeg, .png) at the ingress layer
Run the Spring Boot process under a low-privilege system account with restricted filesystem write scope

bash

# Example: restrict storage directory execution and enforce ownership
chown app:app /var/app/uploads/profile-picture
chmod 750 /var/app/uploads/profile-picture
mount -o remount,noexec /var/app/uploads