CVE-2021-46113
📋 TL;DR
CVE-2021-46113 is a remote code execution vulnerability in KEA-Hotel-ERP open source software that allows attackers to upload malicious PHP files through a file upload vulnerability. This affects all users running vulnerable versions of KEA-Hotel-ERP. Successful exploitation gives attackers full control over the affected system.
💻 Affected Systems
- KEA-Hotel-ERP
📦 What is this software?
Kea Hotel Erp by Kea Hotel Erp Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal sensitive data, install malware, pivot to other systems, and maintain persistent access.
Likely Case
Attackers upload web shells to gain remote access, steal hotel guest data, modify reservations, and potentially disrupt hotel operations.
If Mitigated
With proper file upload validation and web application firewalls, exploitation attempts are blocked and logged for investigation.
🎯 Exploit Status
Multiple public proof-of-concept exploits and demonstration videos are available. The attack requires only web access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative hotel management software or implementing strict workarounds.
🔧 Temporary Workarounds
Restrict PHP file uploads
allConfigure web server to block PHP file uploads and execution in upload directories
# In Apache .htaccess in upload directory:
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
# In Nginx location block:
location ~* \.php$ {
deny all;
return 403;
}
Implement file type validation
allAdd server-side validation to only allow specific safe file extensions
# Example PHP validation snippet:
$allowed_extensions = ['jpg', 'png', 'pdf', 'doc'];
$file_extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
die('Invalid file type');
}
🧯 If You Can't Patch
- Isolate the KEA-Hotel-ERP system in a separate network segment with strict firewall rules
- Implement a web application firewall (WAF) with rules to block PHP file uploads and suspicious requests
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a PHP file to the file upload endpoint. If successful without validation, the system is vulnerable.Check Version:
Check the software version in the admin panel or review the source code for version indicatorsVerify Fix Applied:
Test file upload functionality with PHP files - they should be rejected. Also verify web server configuration blocks PHP execution in upload directories.📡 Detection & Monitoring
Log Indicators:
- PHP file uploads in web server logs
- Unusual POST requests to upload endpoints
- Execution of PHP files from upload directories
Network Indicators:
- HTTP POST requests with PHP file content to upload endpoints
- Subsequent requests to uploaded PHP files
SIEM Query:
source="web_server" AND (uri="*upload*" AND file_extension="php") OR (uri="*/uploads/*.php")🔗 References
- https://blog.pocas.kr/posts/rce-KEA-Hotel-ERP/
- https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#cve-2021-46113
- https://www.youtube.com/watch?v=gnSMrvV5e9w
- https://blog.pocas.kr/posts/rce-KEA-Hotel-ERP/
- https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#cve-2021-46113
- https://www.youtube.com/watch?v=gnSMrvV5e9w
