CVE-2024-57450: ChestnutCMS Path Traversal Vulnerability

CVE-2024-57450 Overview

CVE-2024-57450 is an unrestricted file upload vulnerability affecting ChestnutCMS versions 1.5.0 and earlier. The vulnerability exists within the "Create template" function, which fails to properly validate uploaded files. This security flaw allows attackers to upload malicious files to the server, potentially leading to remote code execution and complete system compromise.

Critical Impact
This unrestricted file upload vulnerability can be exploited remotely without authentication, allowing attackers to upload and execute malicious code on vulnerable ChestnutCMS installations.

Affected Products

ChestnutCMS version 1.5.0 and earlier
1000mz ChestnutCMS (all versions up to and including 1.5.0)

Discovery Timeline

2025-02-03 - CVE-2024-57450 published to NVD
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2024-57450

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The ChestnutCMS application fails to properly restrict the types of files that can be uploaded through its template creation functionality. An attacker can exploit this weakness to upload files containing malicious code, such as web shells or server-side scripts, which can then be executed on the target system.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any prior authentication or user interaction. Successful exploitation could result in complete compromise of the affected system's confidentiality, integrity, and availability.

Root Cause

The root cause of this vulnerability lies in the inadequate input validation within the "Create template" function of ChestnutCMS. The application does not implement sufficient file type checking, file extension validation, or content-type verification when processing uploaded files. This allows an attacker to bypass any weak client-side restrictions and upload arbitrary files to the server.

Attack Vector

The attack vector for CVE-2024-57450 is network-based. An attacker can remotely access the vulnerable template creation functionality and submit a crafted HTTP request containing a malicious file. The attack requires low complexity to execute, as no special conditions or authentication are required.

The typical exploitation flow involves:

Accessing the template creation interface in ChestnutCMS
Uploading a malicious file (e.g., PHP web shell) disguised or uploaded directly
Navigating to the uploaded file's location on the server
Executing arbitrary commands through the uploaded malicious script

For detailed technical information about this vulnerability, refer to the Notion Security Document.

Detection Methods for CVE-2024-57450

Indicators of Compromise

Unusual file uploads in the ChestnutCMS template directories with executable extensions (.php, .jsp, .aspx)
Web server logs showing POST requests to template creation endpoints followed by GET requests to newly created files
Presence of web shell files or scripts with suspicious content in template storage locations
Unexpected outbound network connections from the web server

Detection Strategies

Monitor file system changes in ChestnutCMS template directories for newly created executable files
Implement web application firewall (WAF) rules to detect file upload attacks and malicious payloads
Review web server access logs for suspicious patterns involving the template creation endpoint
Deploy endpoint detection solutions to identify web shell activity and command execution

Monitoring Recommendations

Enable detailed logging for all file upload operations in ChestnutCMS
Configure alerts for new file creation events in template directories
Monitor for process execution initiated by the web server process (e.g., cmd.exe, /bin/sh spawned by Apache/Nginx)
Implement file integrity monitoring on critical ChestnutCMS directories

How to Mitigate CVE-2024-57450

Immediate Actions Required

Upgrade ChestnutCMS to a patched version if available from the vendor
Restrict access to the template creation functionality to trusted administrators only
Implement strict file upload validation including file type, extension, and content verification
Consider temporarily disabling the template creation feature until a patch is applied

Patch Information

At the time of this writing, no official vendor advisory or patch information has been published for CVE-2024-57450. Organizations using ChestnutCMS should monitor the vendor's official channels for security updates and apply patches as soon as they become available.

Workarounds

Implement server-side file type validation that checks both file extensions and MIME types
Configure the web server to prevent execution of scripts in upload directories
Use a web application firewall to filter malicious file upload attempts
Restrict network access to administrative functions including template creation

bash

# Example: Disable script execution in upload directories (Apache)
<Directory "/path/to/chestnutcms/templates">
    Options -ExecCGI
    php_flag engine off
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
    AddType text/plain .php .phtml .php3 .php4 .php5 .phps
</Directory>