CVE-2023-39147
📋 TL;DR
This vulnerability allows attackers to upload malicious image files to Uvdesk 1.1.3, which can lead to remote code execution on the server. Any organization running the affected version of Uvdesk is vulnerable to complete system compromise.
💻 Affected Systems
- Uvdesk
📦 What is this software?
Uvdesk by Webkul
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or use as a pivot point into internal networks
Likely Case
Webshell installation allowing persistent backdoor access and data exfiltration
If Mitigated
File upload blocked or properly validated, preventing exploitation
🎯 Exploit Status
Public exploit code available on Packet Storm, requires only web access to vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.4 or later
Vendor Advisory: https://github.com/uvdesk/community-skeleton/releases
Restart Required: Yes
Instructions:
1. Backup current installation and database. 2. Download latest version from official repository. 3. Replace files with patched version. 4. Clear cache and restart web server.
🔧 Temporary Workarounds
Disable file upload functionality
allTemporarily disable image/file upload features in Uvdesk configuration
Edit Uvdesk configuration to remove upload endpoints or restrict to admin-only
Web Application Firewall rules
allBlock malicious file uploads at the WAF level
Add WAF rules to block file uploads containing PHP/executable code in image files
🧯 If You Can't Patch
- Implement strict file type validation and content inspection for all uploads
- Run Uvdesk in a containerized environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check if running Uvdesk version 1.1.3 via admin panel or version fileCheck Version:
Check composer.json or version file in Uvdesk installation directoryVerify Fix Applied:
Verify version is 1.1.4 or later and test file upload functionality with malicious files📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Uvdesk endpoints
- Files with double extensions (.jpg.php)
- Webshell access patterns in access logs
Network Indicators:
- HTTP POST requests to upload endpoints with executable content
- Outbound connections from Uvdesk server to unknown IPs
SIEM Query:
source="uvdesk_access.log" AND (uri_path="/uploads" OR uri_path="/file/upload") AND status=200 AND size>100000🔗 References
- http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
- https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing
- http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
- https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing
