CVE-2022-2418
📋 TL;DR
CVE-2022-2418 is a critical unrestricted file upload vulnerability in URVE Web Manager's img_upload.php component. Attackers with network access can upload malicious files to execute arbitrary code on affected systems. Organizations using URVE Web Manager are affected.
💻 Affected Systems
- URVE Web Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of internal systems
If Mitigated
Limited impact with proper file upload restrictions and network segmentation in place
🎯 Exploit Status
Exploit requires network access but no authentication; public proof-of-concept available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for security updates 2. Apply any available patches 3. Verify fix by testing upload functionality
🔧 Temporary Workarounds
Disable img_upload.php
linuxRemove or restrict access to vulnerable file upload component
mv /path/to/kreator.html5/img_upload.php /path/to/kreator.html5/img_upload.php.disabled
Implement file upload restrictions
allAdd server-side validation for file types and sizes
🧯 If You Can't Patch
- Implement strict network access controls to restrict access to URVE Web Manager
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Test if img_upload.php accepts file uploads without proper validation by attempting to upload a non-image fileCheck Version:
Check URVE Web Manager documentation or configuration files for version informationVerify Fix Applied:
Verify img_upload.php is disabled or properly validates file types before accepting uploads📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to img_upload.php
- POST requests with non-image file extensions
- Large number of upload attempts
Network Indicators:
- HTTP POST requests to /kreator.html5/img_upload.php with suspicious payloads
SIEM Query:
source="web_logs" AND uri="/kreator.html5/img_upload.php" AND method="POST" AND (file_extension!="jpg" AND file_extension!="png" AND file_extension!="gif")🔗 References
- https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.md
- https://vuldb.com/?id.203901
- https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.md
- https://vuldb.com/?id.203901
