CVE-2021-41560
📋 TL;DR
OpenCATS versions through 0.9.6 contain an unrestricted file upload vulnerability in lib/FileUtility.php that allows remote attackers to upload executable files. This can lead to remote code execution on the server. All OpenCATS installations up to version 0.9.6 are affected.
💻 Affected Systems
- OpenCATS
📦 What is this software?
Opencats by Opencats
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to web shell installation, data exfiltration, or system takeover.
If Mitigated
File uploads blocked or properly validated, preventing malicious file execution.
🎯 Exploit Status
Multiple public exploit tools available (RevCAT), YouTube demonstration video exists, and exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1 and later versions
Vendor Advisory: https://github.com/opencats/OpenCATS/commit/b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1
Restart Required: No
Instructions:
1. Update OpenCATS to the latest version. 2. Apply the specific commit b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1 if not updating fully. 3. Verify file upload validation is properly implemented.
🔧 Temporary Workarounds
Web Server File Extension Blocking
allConfigure web server to block upload/execution of dangerous file extensions
# Apache: Add to .htaccess
<FilesMatch "\.(php|phtml|phar|exe|sh|pl|py|rb)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~*\.(php|phtml|phar|exe|sh|pl|py|rb)$ {
deny all;
}
Disable File Upload Functionality
allTemporarily disable file uploads in OpenCATS configuration
# Edit OpenCATS configuration to disable file uploads
# Modify lib/FileUtility.php or application settings
🧯 If You Can't Patch
- Implement strict file upload validation at the web application firewall (WAF) level
- Restrict network access to OpenCATS to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check OpenCATS version. If version is 0.9.6 or earlier, it's vulnerable. Test by attempting to upload a file with executable extension.Check Version:
# Check OpenCATS version in web interface or configuration files
# Typically found in version.txt or similar fileVerify Fix Applied:
Verify OpenCATS version is after commit b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1. Test file upload with executable extension - should be rejected.📡 Detection & Monitoring
Log Indicators:
- File uploads with executable extensions (.php, .exe, .sh)
- Unusual POST requests to upload endpoints
- Web shell creation in upload directories
Network Indicators:
- POST requests to /lib/FileUtility.php or similar upload endpoints
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_logs" AND (uri_path="/lib/FileUtility.php" OR file_extension IN ("php", "exe", "sh", "pl", "py", "rb")) AND http_method="POST"🔗 References
- https://github.com/Nickguitar/RevCAT
- https://github.com/opencats/OpenCATS/commit/b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1
- https://youtu.be/isiDISag7CM
- https://github.com/Nickguitar/RevCAT
- https://github.com/opencats/OpenCATS/commit/b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1
- https://youtu.be/isiDISag7CM
