CVE-2023-30333
📋 TL;DR
This vulnerability allows attackers to upload malicious files to PerfreeBlog's admin interface, leading to remote code execution. Attackers can gain full control of affected systems by uploading crafted files that execute arbitrary commands. All PerfreeBlog v3.1.2 installations with the vulnerable component are affected.
💻 Affected Systems
- PerfreeBlog
📦 What is this software?
Perfreeblog by Perfree
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal data, deploy ransomware, or pivot to other systems.
Likely Case
Web server compromise leading to data theft, defacement, or deployment of backdoors for persistent access.
If Mitigated
File upload attempts blocked or quarantined with no code execution if proper file validation and execution restrictions are in place.
🎯 Exploit Status
Exploitation requires admin access to the /admin/ThemeController endpoint. The vulnerability is well-documented in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.1.3 or later
Vendor Advisory: https://github.com/perfree/perfree-blog/releases
Restart Required: Yes
Instructions:
1. Backup your current installation and database. 2. Download the latest version from the official repository. 3. Replace all files with the new version. 4. Restart the web server. 5. Verify the admin interface functions correctly.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit access to the /admin/ endpoint to trusted IP addresses only
# Apache: RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.
RewriteRule ^admin/ - [F,L]
# Nginx: location /admin/ { allow 192.168.1.0/24; deny all; }
File Upload Restrictions
allConfigure web server to block uploads of executable file types to the theme directory
# Apache: <Location /admin/ThemeController> SetEnvIf Request_URI \.(php|jsp|asp|sh)$ blockit Order Allow,Deny Allow from all Deny from env=blockit </Location>
# Nginx: location ~* \.(php|jsp|asp|sh)$ { deny all; }
🧯 If You Can't Patch
- Implement strict network access controls to limit admin interface access to trusted IPs only
- Deploy a web application firewall (WAF) with rules to block malicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check if your PerfreeBlog version is 3.1.2 by examining the version file or admin interface. Also verify if the /admin/ThemeController endpoint accepts file uploads without proper validation.Check Version:
grep -r 'version' /path/to/perfreeblog/ || cat /path/to/perfreeblog/version.txtVerify Fix Applied:
After patching, verify the version shows 3.1.3 or later. Test that file uploads to the theme controller now properly validate file types and extensions.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/ThemeController
- Uploads of executable file types (.php, .jsp, .asp, .sh) to theme directories
- Multiple failed upload attempts followed by successful upload
Network Indicators:
- POST requests to /admin/ThemeController with file upload content
- Unusual outbound connections from the web server following file uploads
SIEM Query:
source="web_server_logs" AND (uri="/admin/ThemeController" AND method="POST" AND size>100000) OR (file_extension IN ("php", "jsp", "asp", "sh") AND upload_success="true")