CVE-2024-7903: Dedebiz 6.3.0 RCE Vulnerability

CVE-2024-7903 Overview

A critical unrestricted file upload vulnerability has been identified in DedeBIZ version 6.3.0. This vulnerability exists in the File Extension Handler component, specifically within the admin/media_add.php file. Attackers can exploit this flaw by manipulating the upfile1 argument to upload arbitrary files without proper validation, potentially leading to remote code execution on the target server.

Critical Impact

Authenticated attackers with network access can upload malicious files to the server, potentially enabling remote code execution and complete system compromise.

Affected Products

• DedeBIZ 6.3.0
• DedeBIZ Content Management System (CMS)
• Systems running vulnerable admin/media_add.php component

Discovery Timeline

• 2024-08-18 - CVE-2024-7903 published to NVD
• 2024-08-20 - Last updated in NVD database

Technical Details for CVE-2024-7903

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the media upload functionality within the DedeBIZ administrative interface. When processing file uploads through the admin/media_add.php endpoint, the application fails to properly validate or restrict file extensions submitted via the upfile1 parameter.

The unrestricted file upload vulnerability allows authenticated users to bypass intended security restrictions and upload files with dangerous extensions such as .php, .phtml, or other executable file types. Once uploaded, these malicious files can be accessed directly through the web server, enabling arbitrary code execution within the context of the web application.

The attack requires network access and low-privilege authenticated access to the administrative interface. The vendor was contacted regarding this disclosure but did not respond, leaving users without an official patch.

Root Cause

The root cause of this vulnerability is improper input validation in the file upload handler. The admin/media_add.php script does not implement adequate file extension filtering or content-type verification for the upfile1 parameter. This allows attackers to submit files with executable extensions that should be blocked by the application's security controls. The absence of a whitelist approach for allowed file types and missing server-side validation creates the opportunity for malicious file uploads.

Attack Vector

The attack is conducted remotely over the network. An authenticated attacker with access to the DedeBIZ administrative panel can exploit this vulnerability through the following attack flow:

1. Authenticate to the DedeBIZ admin panel with valid credentials
2. Navigate to the media upload functionality at admin/media_add.php
3. Craft a malicious file (e.g., a PHP webshell) with a dangerous extension
4. Upload the file via the upfile1 parameter, bypassing extension restrictions
5. Access the uploaded file directly via its URL to execute arbitrary code

The vulnerability has been publicly disclosed and exploit details are available through VulDB #275029 and the GitHub Advisory. While no active exploitation has been confirmed in the wild, the public availability of exploit information increases the risk of attacks.

Detection Methods for CVE-2024-7903

Indicators of Compromise

• Suspicious file uploads in the DedeBIZ media directory containing executable extensions (.php, .phtml, .asp, .jsp)
• Unexpected webshell files or scripts appearing in upload directories
• Access logs showing requests to newly uploaded files with executable extensions
• Unusual POST requests to admin/media_add.php with encoded or obfuscated payloads

Detection Strategies

• Monitor HTTP POST requests to admin/media_add.php for suspicious file extension patterns in the upfile1 parameter
• Implement file integrity monitoring on upload directories to detect unauthorized executable files
• Configure web application firewall (WAF) rules to block uploads of dangerous file types
• Review authentication logs for unauthorized access attempts to the administrative interface

Monitoring Recommendations

• Enable detailed logging for all file upload operations in the DedeBIZ application
• Set up alerts for new files with executable extensions created in media upload directories
• Monitor outbound connections from the web server that may indicate webshell activity
• Regularly audit uploaded content for malicious payloads or unexpected file types

How to Mitigate CVE-2024-7903

Immediate Actions Required

• Restrict access to the admin/media_add.php endpoint using IP-based access controls or VPN requirements
• Implement server-side file extension whitelisting to allow only safe file types (images, documents)
• Disable direct execution of uploaded files by configuring the web server to serve them as static content
• Review and remove any suspicious files that may have been uploaded through this vulnerability

Patch Information

No official patch is currently available from the vendor. The vendor was contacted early about this disclosure but did not respond in any way. Users should implement workarounds and mitigations until an official fix is released. Monitor the VulDB entry for updates on patch availability.

Workarounds

• Add server-level file extension restrictions using .htaccess or web server configuration to prevent PHP execution in upload directories
• Implement additional authentication requirements (MFA) for administrative access
• Consider deploying a web application firewall (WAF) to filter malicious upload attempts
• Rename uploaded files to remove executable extensions and store original names in a database

# Apache .htaccess configuration to prevent PHP execution in upload directories
# Place this file in the DedeBIZ media/uploads directory

<FilesMatch "\.(php|phtml|php5|php7|phps|phar|asp|aspx|jsp|jspx|cgi|pl)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Disable PHP engine entirely in upload directory
php_flag engine off