CVE-2023-36319
📋 TL;DR
CVE-2023-36319 is a file upload vulnerability in Openupload Stable v0.4.3 that allows remote attackers to execute arbitrary code via the compress-inc.php file. This affects anyone running the vulnerable version of Openupload, potentially leading to complete system compromise.
💻 Affected Systems
- Openupload Stable
📦 What is this software?
Openupload by Openupload Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/admin privileges, data exfiltration, ransomware deployment, and persistent backdoor installation.
Likely Case
Web server compromise leading to defacement, data theft, and use as pivot point for internal network attacks.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls blocking malicious requests.
🎯 Exploit Status
Exploit requires sending crafted requests to compress-inc.php with malicious file uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://openupload.sourceforge.net/
Restart Required: No
Instructions:
No official patch exists. Consider upgrading to a different file upload solution or implementing strict input validation.
🔧 Temporary Workarounds
Disable compress-inc.php
linuxRemove or rename the vulnerable compress-inc.php file to prevent exploitation.
mv /path/to/openupload/compress-inc.php /path/to/openupload/compress-inc.php.disabled
Implement file upload restrictions
allConfigure web server to block uploads of executable files and restrict file types.
🧯 If You Can't Patch
- Implement strict file upload validation in application code
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Openupload v0.4.3 is installed and if compress-inc.php exists and is accessible.Check Version:
Check Openupload version in documentation or configuration files.Verify Fix Applied:
Verify compress-inc.php is removed/renamed or file upload restrictions are properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to compress-inc.php
- File upload attempts with executable extensions
Network Indicators:
- HTTP requests to compress-inc.php with file upload parameters
SIEM Query:
source="web_logs" AND uri="*compress-inc.php*" AND method="POST"