CVE-2024-55417: DevDojo Voyager RCE Vulnerability

CVE-2024-55417 Overview

CVE-2024-55417 is an Unrestricted File Upload vulnerability (CWE-434) affecting DevDojo Voyager, a popular Laravel admin package through version 1.8.0. The vulnerability allows authenticated users to bypass file type verification when uploading files via the /admin/media/upload endpoint. Successful exploitation enables attackers to upload web shells and achieve arbitrary code execution on the server.

Critical Impact

Authenticated attackers can upload malicious web shells to gain remote code execution on the server, potentially compromising the entire application and underlying infrastructure.

Affected Products

• Thecontrolgroup Voyager through version 1.8.0
• DevDojo Voyager Laravel admin package (all versions up to and including 1.8.0)
• Applications using the vulnerable VoyagerMediaController upload functionality

Discovery Timeline

• 2025-01-30 - CVE-2024-55417 published to NVD
• 2025-05-23 - Last updated in NVD database

Technical Details for CVE-2024-55417

Vulnerability Analysis

This vulnerability resides in the media upload functionality of DevDojo Voyager, specifically within the VoyagerMediaController.php file. The file type verification mechanism can be bypassed by authenticated users, allowing the upload of arbitrary file types including executable scripts. When a malicious PHP web shell is uploaded through the /admin/media/upload endpoint, it can be subsequently accessed and executed, granting the attacker full control over the web server.

The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type), which represents a common weakness where applications fail to properly restrict the types of files that can be uploaded. In this case, the insufficient validation allows attackers to circumvent intended security controls designed to prevent the upload of executable content.

Root Cause

The root cause of this vulnerability lies in the inadequate file type verification implemented in the VoyagerMediaController.php upload handler. The validation logic can be bypassed, allowing files with dangerous extensions (such as .php) to be uploaded to the server. The vulnerable code section is located around line 238 in the controller, where the file type checks fail to comprehensively prevent malicious file uploads. This allows authenticated users with media upload privileges to upload executable files that should normally be blocked.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with valid credentials and media upload permissions can exploit this vulnerability by:

1. Authenticating to the Voyager admin panel
2. Navigating to the media management section
3. Crafting a request to the /admin/media/upload endpoint with a malicious payload
4. Bypassing the file type verification to upload a PHP web shell
5. Accessing the uploaded web shell to execute arbitrary commands on the server

The exploitation requires low privileges (authenticated user with upload access) and no user interaction, making it relatively straightforward to exploit once an attacker has valid credentials.

For detailed technical analysis of this vulnerability, refer to the SonarSource Vulnerability Blog Post which provides comprehensive coverage of the vulnerable code path. The vulnerable code section can be examined in the GitHub VoyagerMediaController Code.

Detection Methods for CVE-2024-55417

Indicators of Compromise

• Presence of unexpected .php, .phtml, or other executable files in media upload directories
• Web server access logs showing requests to unusual files in the media storage path
• File modification timestamps indicating recent uploads of executable content
• Unusual outbound network connections from the web server process

Detection Strategies

• Monitor file system events for creation of PHP or executable files in the Voyager media upload directory
• Implement web application firewall (WAF) rules to detect web shell patterns in uploaded content
• Review web server access logs for POST requests to /admin/media/upload followed by GET requests to newly created files
• Deploy file integrity monitoring (FIM) on media directories to detect unauthorized file additions

Monitoring Recommendations

• Enable detailed logging for the /admin/media/upload endpoint to capture all upload attempts
• Configure alerts for file creation events in media directories that match executable file patterns
• Implement regular security scans of upload directories for known web shell signatures
• Monitor process execution originating from the web server user account for anomalous behavior

How to Mitigate CVE-2024-55417

Immediate Actions Required

• Audit existing files in media upload directories for any suspicious or executable content
• Restrict access to the Voyager admin panel to only trusted IP addresses
• Review and minimize user accounts with media upload permissions
• Implement additional server-side validation for file uploads at the web server level

Patch Information

Organizations using DevDojo Voyager should upgrade to a patched version that addresses this file upload bypass vulnerability. Check the official Voyager GitHub repository for the latest security updates. If no patch is currently available, implement the workarounds described below to reduce exposure until an official fix is released.

Workarounds

• Configure the web server to disable PHP execution in the media upload directory using .htaccess or server configuration
• Implement a whitelist of allowed file extensions at the web server level, blocking all executable types
• Use a separate non-executable storage location or CDN for uploaded media files
• Add custom middleware to perform additional file type validation before files reach the Voyager upload handler

# Apache .htaccess configuration to disable PHP execution in upload directory
# Place this file in the Voyager media upload directory

# Disable PHP execution
<FilesMatch "\.php$">
    SetHandler none
    SetHandler default-handler
    Options -ExecCGI
    RemoveHandler .php
</FilesMatch>

# Alternative: Deny all script execution
<Files "*.php">
    Require all denied
</Files>