CVE-2023-26949
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary PHP files to the onekeyadmin web application through the /admin1/config/update endpoint. Successful exploitation leads to remote code execution with web server privileges. All systems running onekeyadmin v1.3.9 are affected.
💻 Affected Systems
- onekeyadmin
📦 What is this software?
Onekeyadmin by Onekeyadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise - attackers gain full control of the web server, can pivot to internal networks, steal data, deploy ransomware, or establish persistent backdoors.
Likely Case
Webshell deployment leading to data theft, credential harvesting, and use as a foothold for further attacks.
If Mitigated
Attack blocked at WAF/web application firewall level with file upload restrictions and content inspection.
🎯 Exploit Status
Simple HTTP POST request with PHP file upload to vulnerable endpoint. Public exploit code available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Remove or disable onekeyadmin v1.3.9 immediately. Consider migrating to alternative software.
🔧 Temporary Workarounds
Block vulnerable endpoint
allAdd web server rule to block access to /admin1/config/update endpoint
# Apache: RewriteRule ^/admin1/config/update - [F,L]
# Nginx: location ~ ^/admin1/config/update { deny all; }
Restrict PHP file uploads
allConfigure web server to reject .php file uploads to the application
# Apache: <Location "/admin1/config/update">
<FilesMatch "\.php$">
Require all denied
</FilesMatch>
</Location>
🧯 If You Can't Patch
- Isolate affected system from internet and critical internal networks
- Implement strict network segmentation and monitor all traffic to/from the system
🔍 How to Verify
Check if Vulnerable:
Check if onekeyadmin v1.3.9 is installed and accessible at /admin1/config/update endpointCheck Version:
Check application files or documentation for version informationVerify Fix Applied:
Attempt to upload a test PHP file to /admin1/config/update - should be blocked or rejected📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin1/config/update with .php file uploads
- Web server logs showing file uploads to admin directory
- Unusual PHP file creation in web directories
Network Indicators:
- HTTP traffic to /admin1/config/update with file upload content
- POST requests with PHP file content to admin endpoints
SIEM Query:
source="web_server" AND (uri="/admin1/config/update" OR uri="/admin1/config/update/*") AND method="POST" AND content_type="multipart/form-data"