CVE-2022-32994
📋 TL;DR
Halo CMS v1.5.3 contains an arbitrary file upload vulnerability in the /api/admin/attachments/upload endpoint that allows authenticated attackers to upload malicious files. This affects all Halo CMS v1.5.3 installations with the vulnerable component enabled. Attackers can achieve remote code execution by uploading webshells or other malicious payloads.
💻 Affected Systems
- Halo CMS
📦 What is this software?
Halo by Halo
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover via remote code execution.
Likely Case
Webshell upload leading to persistent backdoor access, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact with proper file type validation, restricted upload directories, and web application firewall rules blocking malicious uploads.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated; public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.5.4 or later
Vendor Advisory: https://github.com/halo-dev/halo/releases
Restart Required: Yes
Instructions:
1. Backup your Halo CMS installation and database. 2. Download Halo CMS v1.5.4 or later from the official repository. 3. Replace the existing installation with the updated version. 4. Restart the Halo CMS service. 5. Verify the patch by checking the version and testing the upload functionality.
🔧 Temporary Workarounds
Restrict Upload Endpoint Access
allUse web server configuration to block or restrict access to /api/admin/attachments/upload endpoint
# For nginx: location ~ ^/api/admin/attachments/upload { deny all; }
# For Apache: <Location "/api/admin/attachments/upload"> Require all denied </Location>
Implement File Upload Validation
allAdd server-side validation to restrict allowed file types and extensions
# Example in application configuration or middleware
# Restrict to specific MIME types and extensions
🧯 If You Can't Patch
- Disable the attachments upload functionality entirely if not required
- Implement strict network segmentation and firewall rules to limit access to the Halo CMS instance
🔍 How to Verify
Check if Vulnerable:
Check if running Halo CMS v1.5.3 and test if /api/admin/attachments/upload accepts restricted file types without proper validation.Check Version:
Check Halo CMS admin dashboard or configuration files for version informationVerify Fix Applied:
Verify version is v1.5.4 or later and test that file uploads now properly validate file types and extensions.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /api/admin/attachments/upload
- Uploads of executable files (php, jsp, asp, etc.)
- Multiple failed upload attempts followed by successful suspicious upload
Network Indicators:
- HTTP POST requests to /api/admin/attachments/upload with unusual file extensions
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_server_logs" AND (uri="/api/admin/attachments/upload" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp"))