CVE-2024-6114: Monbela Tourist Inn RCE Vulnerability

CVE-2024-6114 Overview

A critical unrestricted file upload vulnerability has been identified in itsourcecode Monbela Tourist Inn Online Reservation System up to version 1.0. The vulnerability exists in the controller.php file, where improper handling of the image parameter allows attackers to upload arbitrary files without proper validation or restrictions. This flaw can be exploited remotely, potentially leading to remote code execution if malicious files such as web shells are uploaded to the server.

Critical Impact
Remote attackers can exploit this unrestricted file upload vulnerability to upload malicious files, potentially achieving remote code execution on affected systems running the Monbela Tourist Inn Online Reservation System.

Affected Products

Janobe Monbela Tourist Inn Online Reservation System version 1.0
itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0

Discovery Timeline

June 18, 2024 - CVE-2024-6114 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6114

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected component is the controller.php file within the Monbela Tourist Inn Online Reservation System. The system fails to properly validate or restrict file types during the upload process when handling the image parameter.

When a user uploads an image through the reservation system, the application does not implement adequate security controls to verify that the uploaded file is actually an image. This allows an attacker to bypass intended restrictions and upload executable files such as PHP web shells, which can then be accessed directly through the web server to execute arbitrary commands.

The network-accessible attack vector means that any remote attacker who can reach the vulnerable endpoint can attempt exploitation without requiring authentication or user interaction. The exploit for this vulnerability has been publicly disclosed, increasing the risk of widespread exploitation.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and file type verification in the controller.php file. The application accepts user-supplied files through the image parameter without implementing essential security controls such as:

File extension whitelisting
MIME type validation
File content verification (magic bytes checking)
Secure file storage outside the web root
Randomized file naming to prevent predictable access

Attack Vector

The attack can be launched remotely over the network against the controller.php endpoint. An attacker can craft a malicious HTTP request containing a dangerous file disguised as an image upload. The vulnerable parameter is image, which accepts the uploaded file content.

The exploitation workflow involves an attacker submitting a crafted multipart form request to the vulnerable endpoint, uploading a PHP web shell or other malicious script with a permitted extension bypass, and then accessing the uploaded file directly through the web server to achieve code execution.

For technical details regarding the exploitation methodology, refer to the GitHub CVE Discussion and VulDB entry #268866.

Detection Methods for CVE-2024-6114

Indicators of Compromise

Presence of unexpected PHP files or executable scripts in image upload directories
Web server access logs showing requests to recently uploaded files with suspicious extensions
Unusual file extensions in upload directories (e.g., .php, .phtml, .php5, .phar)
Evidence of web shell activity such as command execution patterns in server logs

Detection Strategies

Monitor file upload directories for files with executable extensions or suspicious content
Implement web application firewall (WAF) rules to detect file upload bypass attempts
Analyze HTTP POST requests to controller.php for multipart form data containing non-image content
Review web server logs for access patterns indicating exploitation of uploaded malicious files

Monitoring Recommendations

Enable detailed logging for the web application and monitor for anomalous file upload activity
Configure file integrity monitoring on upload directories to detect unauthorized file modifications
Set up alerts for outbound connections originating from the web server that may indicate web shell activity
Regularly scan upload directories for files containing PHP code or other executable content

How to Mitigate CVE-2024-6114

Immediate Actions Required

Restrict access to the vulnerable controller.php endpoint until a patch is applied
Implement server-side file type validation that checks both file extensions and MIME types
Configure the web server to prevent execution of scripts in upload directories
Review and remove any suspicious files that may have been uploaded to the system

Patch Information

No official vendor patch has been identified for this vulnerability at this time. Organizations using Monbela Tourist Inn Online Reservation System should contact the vendor for remediation guidance or implement the workarounds described below. For additional information, consult the VulDB advisory.

Workarounds

Disable the file upload functionality in controller.php if not critical to operations
Implement strict file extension whitelisting allowing only image formats (.jpg, .jpeg, .png, .gif)
Add MIME type validation and magic byte verification to confirm uploaded files are legitimate images
Store uploaded files outside the web root and serve them through a controlled handler
Configure the web server to deny script execution in upload directories

bash

# Apache configuration to prevent script execution in upload directory
# Add to .htaccess in the uploads folder
<Directory /var/www/html/uploads>
    # Disable PHP execution
    php_flag engine off
    
    # Deny access to executable file types
    <FilesMatch "\.(php|phtml|php5|php7|phar|cgi|pl|py|asp|aspx|sh|bash)$">
        Require all denied
    </FilesMatch>
    
    # Only allow image file types
    <FilesMatch "\.(?i:gif|jpe?g|png|webp)$">
        Require all granted
    </FilesMatch>
</Directory>