CVE-2024-57450: ChestnutCMS Path Traversal Vulnerability

CVE-2024-57450 Overview

CVE-2024-57450 is an unrestricted file upload vulnerability affecting ChestnutCMS versions 1.5.0 and earlier. The vulnerability exists within the "Create template" function, which fails to properly validate uploaded files. This security flaw allows attackers to upload malicious files to the server, potentially leading to remote code execution and complete system compromise.

Critical Impact

This unrestricted file upload vulnerability can be exploited remotely without authentication, allowing attackers to upload and execute malicious code on vulnerable ChestnutCMS installations.

Affected Products

• ChestnutCMS version 1.5.0 and earlier
• 1000mz ChestnutCMS (all versions up to and including 1.5.0)

Discovery Timeline

• 2025-02-03 - CVE-2024-57450 published to NVD
• 2025-05-13 - Last updated in NVD database

Technical Details for CVE-2024-57450

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The ChestnutCMS application fails to properly restrict the types of files that can be uploaded through its template creation functionality. An attacker can exploit this weakness to upload files containing malicious code, such as web shells or server-side scripts, which can then be executed on the target system.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any prior authentication or user interaction. Successful exploitation could result in complete compromise of the affected system's confidentiality, integrity, and availability.

Root Cause

The root cause of this vulnerability lies in the inadequate input validation within the "Create template" function of ChestnutCMS. The application does not implement sufficient file type checking, file extension validation, or content-type verification when processing uploaded files. This allows an attacker to bypass any weak client-side restrictions and upload arbitrary files to the server.

Attack Vector

The attack vector for CVE-2024-57450 is network-based. An attacker can remotely access the vulnerable template creation functionality and submit a crafted HTTP request containing a malicious file. The attack requires low complexity to execute, as no special conditions or authentication are required.

The typical exploitation flow involves:

1. Accessing the template creation interface in ChestnutCMS
2. Uploading a malicious file (e.g., PHP web shell) disguised or uploaded directly
3. Navigating to the uploaded file's location on the server
4. Executing arbitrary commands through the uploaded malicious script

For detailed technical information about this vulnerability, refer to the Notion Security Document.

Detection Methods for CVE-2024-57450

Indicators of Compromise

• Unusual file uploads in the ChestnutCMS template directories with executable extensions (.php, .jsp, .aspx)
• Web server logs showing POST requests to template creation endpoints followed by GET requests to newly created files
• Presence of web shell files or scripts with suspicious content in template storage locations
• Unexpected outbound network connections from the web server

Detection Strategies

• Monitor file system changes in ChestnutCMS template directories for newly created executable files
• Implement web application firewall (WAF) rules to detect file upload attacks and malicious payloads
• Review web server access logs for suspicious patterns involving the template creation endpoint
• Deploy endpoint detection solutions to identify web shell activity and command execution

Monitoring Recommendations

• Enable detailed logging for all file upload operations in ChestnutCMS
• Configure alerts for new file creation events in template directories
• Monitor for process execution initiated by the web server process (e.g., cmd.exe, /bin/sh spawned by Apache/Nginx)
• Implement file integrity monitoring on critical ChestnutCMS directories

How to Mitigate CVE-2024-57450

Immediate Actions Required

• Upgrade ChestnutCMS to a patched version if available from the vendor
• Restrict access to the template creation functionality to trusted administrators only
• Implement strict file upload validation including file type, extension, and content verification
• Consider temporarily disabling the template creation feature until a patch is applied

Patch Information

At the time of this writing, no official vendor advisory or patch information has been published for CVE-2024-57450. Organizations using ChestnutCMS should monitor the vendor's official channels for security updates and apply patches as soon as they become available.

Workarounds

• Implement server-side file type validation that checks both file extensions and MIME types
• Configure the web server to prevent execution of scripts in upload directories
• Use a web application firewall to filter malicious file upload attempts
• Restrict network access to administrative functions including template creation

# Example: Disable script execution in upload directories (Apache)
<Directory "/path/to/chestnutcms/templates">
    Options -ExecCGI
    php_flag engine off
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
    AddType text/plain .php .phtml .php3 .php4 .php5 .phps
</Directory>