CVE-2024-8330: 6SHR System RCE Vulnerability

CVE-2024-8330 Overview

CVE-2024-8330 is an unrestricted file upload vulnerability in the 6SHR system from Gether Technology. The application fails to validate the type of files submitted through its upload functionality. Authenticated attackers with standard user privileges can upload web shell scripts to the server. Once uploaded, the attacker executes arbitrary operating system commands under the context of the web application. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can achieve remote code execution on affected 6SHR servers, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Gether Technology 6SHR system (all versions prior to vendor fix)
CPE: cpe:2.3:a:6shr_system_project:6shr_system
Deployments exposing the file upload endpoint to authenticated users

Discovery Timeline

2024-08-30 - CVE-2024-8330 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8330

Vulnerability Analysis

The 6SHR system exposes a file upload feature accessible to users holding regular application privileges. The server-side handler accepts uploaded files without enforcing a strict allow-list on file type, extension, or MIME content. An attacker submits a file containing server-executable code, such as a PHP or ASP web shell, and the application stores it inside a directory served by the web server. Requesting the uploaded file triggers execution by the underlying runtime. The attacker then issues arbitrary commands through the shell interface, inheriting the privileges of the web application process.

Root Cause

The root cause is missing or insufficient validation of uploaded file content and extensions in the 6SHR upload handler. The application trusts client-supplied metadata and does not enforce server-side allow-listing of permitted file types. Uploaded files are written to a web-accessible path without renaming or sandboxing. This combination maps directly to CWE-434.

Attack Vector

Exploitation requires network access to the application and a valid low-privilege account. The attacker authenticates, navigates to the file upload feature, and submits a crafted script file with an executable extension recognized by the web server. After the upload succeeds, the attacker sends an HTTP request to the stored file URL. The server executes the script and returns command output. No user interaction from an administrator is required.

No public proof-of-concept code is available. See the TWCert Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-8330

Indicators of Compromise

Unexpected files with extensions such as .php, .jsp, .asp, or .aspx appearing in 6SHR upload directories
Outbound network connections initiated by the 6SHR web application process to unfamiliar hosts
Web server logs showing POST requests to the upload endpoint followed by GET requests to newly created files
Child processes such as cmd.exe, powershell.exe, or /bin/sh spawned by the web server process

Detection Strategies

Monitor the web server process tree for unexpected shell or interpreter child processes
Alert on file writes to web-accessible directories that contain server-side script extensions
Correlate authenticated upload events with subsequent requests to newly created static paths

Monitoring Recommendations

Enable full HTTP access logging on the 6SHR web server, including request bodies where feasible
Baseline the contents of upload directories and alert on new executable file types
Forward web server, process, and file integrity events to a central data lake for correlation

How to Mitigate CVE-2024-8330

Immediate Actions Required

Apply the vendor-provided update for the 6SHR system as referenced in the TWCert advisory
Restrict access to the 6SHR application to trusted networks until the patch is deployed
Audit user accounts and remove unused low-privilege accounts that could be leveraged for exploitation
Review upload directories for unauthorized script files and remove any identified web shells

Patch Information

Gether Technology has released fixed versions coordinated through TWCert. Administrators should consult the TWCert Security Notice for version details and upgrade instructions. Verify integrity of the deployed binaries and confirm the upload validation logic is in place after upgrade.

Workarounds

Configure the web server to deny execution of script interpreters within upload directories, for example by removing handler mappings
Enforce a strict server-side allow-list of file extensions and MIME types at a reverse proxy or WAF layer
Rename uploaded files with random identifiers and store them outside the web root where possible

bash

# Example Apache configuration to disable script execution in the upload directory
<Directory "/var/www/6shr/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .php3 .php4 .php5 .phar
    RemoveType .php .phtml .php3 .php4 .php5 .phar
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    Options -ExecCGI
</Directory>