CVE-2024-6084: Pool Of Bethesda System RCE Vulnerability

CVE-2024-6084 Overview

A critical unrestricted file upload vulnerability has been identified in itsourcecode Pool of Bethesda Online Reservation System version 1.0. The vulnerability exists in the uploadImage function within the file /admin/mod_room/controller.php?action=add. This flaw allows remote attackers to upload arbitrary files without proper validation, potentially leading to remote code execution on the affected server.

Critical Impact

Remote attackers can exploit this vulnerability to upload malicious files (such as web shells) to the server, potentially gaining unauthorized access and full control over the affected system.

Affected Products

• Janobe Pool of Bethesda Online Reservation System version 1.0

Discovery Timeline

• June 18, 2024 - CVE-2024-6084 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6084

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The uploadImage function in the administrative room management controller fails to properly validate uploaded files. Without adequate file type restrictions, content validation, or filename sanitization, attackers can bypass intended security controls and upload executable files to the web server.

The vulnerability is network-accessible, meaning attackers can exploit it remotely without requiring any prior authentication or user interaction. Once a malicious file is uploaded, it can be accessed directly through the web server, enabling arbitrary code execution within the context of the web application.

Root Cause

The root cause of this vulnerability lies in the inadequate input validation within the uploadImage function. The application does not implement proper security controls such as:

• File extension whitelisting to restrict allowed file types
• MIME type validation to verify actual file content
• File content inspection to detect malicious payloads
• Secure storage mechanisms that prevent direct execution of uploaded files

This allows attackers to upload files with dangerous extensions (e.g., .php, .phtml, .asp) that can be executed by the web server.

Attack Vector

The attack is executed remotely over the network by targeting the vulnerable endpoint at /admin/mod_room/controller.php?action=add. An attacker crafts a malicious HTTP POST request containing a web shell or other malicious payload disguised as an image file. The application accepts and stores the file without proper validation, and the attacker can then access the uploaded file directly to execute arbitrary commands on the server.

The vulnerability mechanism involves manipulating the image parameter in the file upload request. Since no proper validation occurs, the attacker can upload PHP files or other server-side scripts that, when accessed, execute arbitrary code with the privileges of the web server process. For detailed technical analysis, refer to the GitHub Issue Discussion and VulDB entry #268825.

Detection Methods for CVE-2024-6084

Indicators of Compromise

• Unusual files with executable extensions (.php, .phtml, .asp, .aspx, .jsp) appearing in upload directories
• Web server access logs showing requests to recently uploaded files in image upload directories
• Unexpected outbound network connections from the web server process
• New or modified files in the /admin/mod_room/ directory or related upload paths

Detection Strategies

• Monitor file system changes in web-accessible upload directories for files with executable extensions
• Implement web application firewall (WAF) rules to detect and block file upload attempts containing script content
• Review web server access logs for patterns indicating exploitation attempts targeting /admin/mod_room/controller.php
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities such as web shell execution

Monitoring Recommendations

• Enable detailed logging for the Pool of Bethesda Online Reservation System application, particularly for file upload operations
• Configure alerts for any new executable files created in web-accessible directories
• Monitor process creation events spawned by web server processes that may indicate command execution via uploaded web shells

How to Mitigate CVE-2024-6084

Immediate Actions Required

• Disable or restrict access to the affected file upload functionality at /admin/mod_room/controller.php?action=add until a patch is available
• Implement network-level access controls to limit administrative interface access to trusted IP addresses only
• Audit existing upload directories for any suspicious or unauthorized files and remove them immediately
• Consider taking the affected application offline if it is exposed to untrusted networks

Patch Information

At the time of this publication, no official vendor patch has been released for this vulnerability. System administrators should monitor the vendor's official channels and the VulDB entry for updates regarding security patches. Given the critical nature of this vulnerability, consider implementing alternative reservation systems until a fix is available.

Workarounds

• Configure the web server to prevent execution of scripts in upload directories by adding appropriate directives (e.g., disabling PHP execution in upload folders)
• Implement file upload validation at the web server level using .htaccess rules or server configuration to whitelist only image file extensions
• Deploy a reverse proxy or WAF in front of the application to inspect and filter file upload requests
• Restrict administrative access to the application through VPN or IP whitelisting

# Apache configuration to disable PHP execution in upload directories
# Add to .htaccess in the upload directory or httpd.conf

<Directory "/path/to/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .php3 .php4 .php5
    <FilesMatch "\.(php|phtml|php3|php4|php5)$">
        Deny from all
    </FilesMatch>
</Directory>