CVE-2024-5377: Vehicle Management System RCE Vulnerability

CVE-2024-5377 Overview

A critical unrestricted file upload vulnerability has been identified in SourceCodester Vehicle Management System version 1.0. This vulnerability affects the /newvehicle.php file, where improper validation of the file argument allows attackers to upload arbitrary files to the server. The vulnerability can be exploited remotely without authentication, potentially leading to remote code execution if malicious executable files are uploaded.

Critical Impact

Remote attackers can exploit this unrestricted file upload vulnerability to upload malicious files, potentially achieving code execution on the target server and compromising the entire vehicle management system.

Affected Products

• Warrendaloyan Vehicle Management System 1.0
• SourceCodester Vehicle Management System 1.0

Discovery Timeline

• 2024-05-26 - CVE-2024-5377 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-5377

Vulnerability Analysis

This vulnerability stems from a failure to properly validate file uploads in the Vehicle Management System's new vehicle creation functionality. The /newvehicle.php endpoint accepts file uploads through the file parameter without enforcing restrictions on file types, extensions, or content. This classic unrestricted file upload vulnerability (CWE-434) allows attackers to bypass intended security controls and upload files of any type to the server.

The network-accessible nature of this vulnerability means that any remote attacker can target exposed instances of the Vehicle Management System. The lack of authentication requirements further compounds the risk, as no credentials are needed to exploit the vulnerability. Upon successful exploitation, attackers may gain the ability to execute arbitrary code on the server, access sensitive data, or use the compromised system as a pivot point for further attacks within the network.

Root Cause

The root cause of CVE-2024-5377 is the absence of proper file upload validation in the /newvehicle.php script. The application fails to implement critical security controls including file type verification, extension whitelisting, MIME type checking, and content inspection. Without these safeguards, the application blindly accepts any file submitted through the upload functionality, storing it in an accessible location on the server.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation without requiring user interaction or prior authentication. An attacker can craft a malicious HTTP POST request to the /newvehicle.php endpoint, including a weaponized file in the file parameter. If the server executes uploaded files (such as PHP scripts in a web-accessible directory), the attacker can achieve remote code execution by subsequently accessing the uploaded malicious file through the web server.

The exploitation process typically involves uploading a web shell or backdoor script disguised as an image or legitimate vehicle-related file. Once uploaded, the attacker navigates to the uploaded file's URL to trigger execution, establishing unauthorized access to the system.

Detection Methods for CVE-2024-5377

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .jsp) appearing in upload directories
• Web server access logs showing requests to unusual file paths within upload directories
• File system modifications indicating new files with suspicious content in the /newvehicle.php upload path
• Outbound network connections originating from the web server process to unknown external hosts

Detection Strategies

• Monitor HTTP POST requests to /newvehicle.php for file upload attempts containing executable content
• Implement file integrity monitoring on upload directories to detect unauthorized file additions
• Review web application firewall (WAF) logs for attempts to upload files with dangerous extensions or MIME types
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activity following successful file uploads

Monitoring Recommendations

• Enable detailed logging for all file upload operations in the Vehicle Management System
• Configure real-time alerts for file creation events in web-accessible directories
• Implement network traffic analysis to detect command and control communications following potential compromise
• Review web server process behavior for anomalous child process spawning or network activity

How to Mitigate CVE-2024-5377

Immediate Actions Required

• Remove or restrict access to the Vehicle Management System from public networks until patched
• Implement web application firewall rules to block malicious file upload attempts
• Audit upload directories for any suspicious files that may have been uploaded prior to mitigation
• Consider disabling the vehicle creation functionality temporarily if it is not business-critical

Patch Information

At the time of this writing, no official patch has been released by the vendor for CVE-2024-5377. Organizations using the affected Vehicle Management System should monitor for security updates from SourceCodester. For additional technical details, refer to the VulDB entry and the GitHub CVE Issue Discussion.

Workarounds

• Implement server-side file type validation to restrict uploads to specific safe file types (e.g., images only)
• Configure the web server to prevent execution of uploaded files by disabling script execution in upload directories
• Add a file extension whitelist that only permits non-executable file types such as .jpg, .png, or .pdf
• Store uploaded files outside of the web root directory and serve them through a separate download handler
• Rename uploaded files to random names without preserving the original extension

# Example Apache configuration to prevent script execution in upload directories
<Directory "/var/www/html/uploads">
    # Disable PHP execution in upload directory
    php_admin_flag engine off
    
    # Prevent execution of other script types
    <FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|aspx|cgi|sh)$">
        Require all denied
    </FilesMatch>
</Directory>