CVE-2023-33386
📋 TL;DR
MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the admin attachment upload interface that allows attackers to upload malicious files to the server. This affects all systems running MarsCTF 1.2.1 with the vulnerable file upload functionality enabled. Attackers can potentially execute arbitrary code on the server.
💻 Affected Systems
- MarsCTF
📦 What is this software?
Marsctf by Marsctf Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Webshell upload leading to server compromise, data theft, and potential pivot to internal systems.
If Mitigated
File upload blocked or sanitized, limiting impact to denial of service if upload attempts overwhelm the system.
🎯 Exploit Status
Exploitation requires admin credentials or authentication bypass. The vulnerability is in CTFFileServiceImpl.java line 46 where file upload validation is insufficient.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Implement file upload validation
allAdd server-side validation to restrict file types, check file signatures, and sanitize filenames.
Modify CTFFileServiceImpl.java to add proper file validation before processing uploads
Restrict upload directory permissions
linuxSet upload directory to read-only for web server and prevent execution of uploaded files.
chmod 755 /path/to/upload/directory
chown www-data:www-data /path/to/upload/directory
🧯 If You Can't Patch
- Disable the vulnerable file upload functionality entirely in the admin interface
- Implement a web application firewall (WAF) with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running MarsCTF version 1.2.1 and examine CTFFileServiceImpl.java line 46 for insufficient file validation.Check Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Test file upload functionality with malicious files to ensure they are rejected or properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to admin interface
- Uploads of executable files (.php, .jsp, .war)
- Multiple failed upload attempts
Network Indicators:
- POST requests to file upload endpoints with suspicious filenames or content
SIEM Query:
source="web_server" AND (uri="/admin/upload" OR uri="/api/upload") AND (filename="*.php" OR filename="*.jsp" OR filename="*.war")🔗 References
- https://github.com/b1ackc4t/MarsCTF/blob/V1.2.1/src/main/java/com/b1ackc4t/marsctfserver/service/impl/CTFFileServiceImpl.java#L46
- https://github.com/b1ackc4t/MarsCTF/issues/10
- https://github.com/b1ackc4t/MarsCTF/blob/V1.2.1/src/main/java/com/b1ackc4t/marsctfserver/service/impl/CTFFileServiceImpl.java#L46
- https://github.com/b1ackc4t/MarsCTF/issues/10
