CVE-2024-8164: Beikeshop Unrestricted Upload Vulnerability

CVE-2024-8164 Overview

CVE-2024-8164 is an unrestricted file upload vulnerability in Chengdu Everbrite Network Technology BeikeShop through version 1.5.5. The flaw resides in the rename function of /Admin/Http/Controllers/FileManagerController.php. Attackers can manipulate the new_name argument to bypass file type restrictions and upload arbitrary files. The issue is categorized under [CWE-284] Improper Access Control. Exploitation requires network access and low-level authentication. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched deployments. Upgrading to version 1.6.0 remediates the flaw.

Critical Impact
Authenticated attackers can rename files to attacker-controlled extensions, enabling arbitrary file upload and potential code execution on the underlying web server.

Affected Products

BeikeShop versions up to and including 1.5.5
Component: /Admin/Http/Controllers/FileManagerController.php
Vendor: Chengdu Everbrite Network Technology

Discovery Timeline

2024-08-26 - CVE-2024-8164 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8164

Vulnerability Analysis

The vulnerability affects the file manager component of the BeikeShop e-commerce platform. The rename function in FileManagerController.php accepts a user-supplied new_name parameter without adequate validation of the target file extension or path. An authenticated attacker with access to the admin file manager can rename an otherwise benign uploaded file to an executable extension such as .php. Once renamed, the file can be requested via HTTP to trigger server-side execution. The root defect is a broken access control and input validation gap within the file management workflow.

Root Cause

The underlying weakness maps to [CWE-284] Improper Access Control. The rename handler trusts the client-supplied destination name and does not enforce an allowlist of permitted extensions or a sanitization routine on the resulting filename. Because the check is missing, existing upload restrictions on the initial write path can be bypassed by first uploading an allowed file type and then renaming it.

Attack Vector

The attack is remote and network-based. An attacker who possesses valid low-privilege credentials to the admin file manager issues a crafted request to the rename endpoint, supplying a new_name value with an executable extension. No user interaction is required. Public disclosure of the exploit technique lowers the barrier for reuse against internet-exposed BeikeShop instances.

No verified public exploit code is referenced in the enriched data. See the GitHub CVE Analysis and VulDB entry #275762 for additional technical detail.

Detection Methods for CVE-2024-8164

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) appearing in BeikeShop upload or public directories after admin session activity
HTTP POST requests to the file manager rename endpoint containing a new_name parameter ending in a server-executable extension
Web server access log entries showing direct GET requests to newly created files inside upload paths
Unexplained outbound network connections originating from the web server process following file manager activity

Detection Strategies

Monitor web server logs for calls to FileManagerController routes, correlating rename actions with subsequent requests to the renamed file path
Deploy web application firewall (WAF) rules that inspect new_name values and block extensions associated with server-side execution
Track file integrity in BeikeShop upload directories and alert on new executable files

Monitoring Recommendations

Enable verbose audit logging on the BeikeShop admin panel, including all file manager operations with actor identity
Forward web server, application, and endpoint telemetry to a centralized data lake for cross-source correlation and retention
Baseline normal admin file operations and alert on anomalies such as rapid successive rename actions or renames to executable extensions

How to Mitigate CVE-2024-8164

Immediate Actions Required

Upgrade BeikeShop to version 1.6.0 or later, which contains the vendor fix for this issue
Audit all files within BeikeShop upload and public directories and remove any unauthorized executable files
Rotate credentials for admin accounts that had access to the file manager during the exposure window
Restrict admin panel exposure to trusted IP ranges or a VPN until the upgrade is completed

Patch Information

The vendor addressed CVE-2024-8164 in BeikeShop 1.6.0. Administrators should follow the vendor upgrade procedure and validate that the FileManagerController.phprename function enforces extension allowlisting post-upgrade. Refer to the VulDB advisory for tracking metadata.

Workarounds

Configure the web server to deny execution of PHP and other script handlers within BeikeShop upload directories
Apply WAF signatures that reject rename requests where new_name contains executable extensions or path traversal sequences
Temporarily disable the file manager module for non-essential admin roles until the patch is deployed

bash

# Example nginx configuration to block script execution in upload paths
location ~ ^/public/upload/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}