CVE-2024-7917: Douco DouPHP RCE Vulnerability

CVE-2024-7917 Overview

A critical unrestricted file upload vulnerability has been discovered in DouPHP 1.7 Release 20220822. This vulnerability affects the Favicon Handler component within the /admin/system.php file. By manipulating the site_favicon argument, an attacker can upload arbitrary files to the server without proper validation, potentially leading to remote code execution or other malicious activities.

Critical Impact

Attackers with administrative access can exploit this unrestricted file upload vulnerability to upload malicious files, potentially achieving remote code execution on the target server.

Affected Products

• DouPHP 1.7 Release 20220822
• Douco DouPHP CMS platforms using vulnerable versions

Discovery Timeline

• August 18, 2024 - CVE-2024-7917 published to NVD
• August 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-7917

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable component resides in the Favicon Handler functionality of DouPHP's administrative interface. The application fails to properly validate or restrict the file types that can be uploaded through the site_favicon parameter in /admin/system.php.

When processing favicon uploads, the application accepts user-supplied files without adequate content-type verification, file extension validation, or proper sanitization. This allows an authenticated administrator to upload files with dangerous extensions (such as .php) that can subsequently be executed on the server.

The network-based attack vector means this vulnerability can be exploited remotely, though it requires authenticated administrative privileges to access the vulnerable endpoint.

Root Cause

The root cause of this vulnerability is insufficient input validation in the favicon upload functionality. The application does not implement proper file type restrictions, allowing files with executable extensions to be uploaded. Specifically, the site_favicon parameter handling lacks:

• File extension whitelisting
• MIME type validation
• Content inspection to verify actual file contents
• Proper file storage outside of web-accessible directories

Attack Vector

The attack can be launched remotely by an authenticated administrator through the following approach:

1. The attacker gains access to the DouPHP administrative panel
2. Navigates to the system settings where favicon configuration is available
3. Uploads a malicious file (e.g., PHP web shell) disguised as a favicon through the site_favicon parameter
4. The malicious file is stored in a web-accessible directory
5. The attacker accesses the uploaded file directly via its URL, triggering code execution

The exploit for this vulnerability has been disclosed publicly, making it accessible to potential attackers. For technical details, refer to the Shikangsi Wiki Post documenting the vulnerability.

Detection Methods for CVE-2024-7917

Indicators of Compromise

• Unexpected file uploads in favicon or image directories with executable extensions (.php, .phtml, .phar)
• Suspicious HTTP POST requests to /admin/system.php containing file upload payloads
• Newly created PHP files in web-accessible directories that were not part of legitimate updates
• Web shell signatures or backdoor patterns in uploaded files

Detection Strategies

• Monitor file system changes in web directories for newly created executable files
• Implement web application firewall (WAF) rules to detect malicious file upload attempts
• Review access logs for unusual POST requests to /admin/system.php with large payload sizes
• Deploy file integrity monitoring (FIM) on critical web directories to detect unauthorized modifications

Monitoring Recommendations

• Enable detailed logging on the DouPHP administrative interface, particularly for file upload operations
• Configure alerts for any new file creation events in web-accessible upload directories
• Monitor for suspicious outbound connections that could indicate web shell activity
• Implement SentinelOne's behavioral AI detection to identify post-exploitation activities resulting from successful file upload attacks

How to Mitigate CVE-2024-7917

Immediate Actions Required

• Restrict access to the DouPHP administrative panel to trusted IP addresses only
• Implement strong authentication mechanisms and review administrative user accounts
• Apply file upload restrictions at the web server level to prevent executable file uploads
• Remove or disable the favicon upload functionality if not required

Patch Information

No official patch information is currently available from the vendor. Organizations using DouPHP 1.7 Release 20220822 should monitor for security updates from Douco. Additional vulnerability details can be found at VulDB Entry #275042.

Workarounds

• Configure web server rules to block execution of uploaded files in favicon directories
• Implement a Web Application Firewall (WAF) with rules to filter malicious file upload attempts
• Modify the application code to enforce strict file type validation (whitelist only image formats like .ico, .png)
• Store uploaded files outside the web root and serve them through a secure handler

# Apache configuration to prevent script execution in upload directories
<Directory "/path/to/douphp/uploads">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>