CVE-2024-0864
📋 TL;DR
CVE-2024-0864 is a remote code execution vulnerability in Laragon's Simple Ajax Uploader plugin due to improper input validation in file_upload.php. Attackers can upload malicious files to execute arbitrary code on affected systems. Only Laragon users who enable the vulnerable plugin are affected.
💻 Affected Systems
- Laragon with Simple Ajax Uploader plugin
📦 What is this software?
Laragon by Laragon
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, install malware, steal data, or pivot to other systems.
Likely Case
Web server compromise leading to data theft, defacement, or use as a foothold for further attacks.
If Mitigated
No impact if plugin is disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires file upload capability and knowledge of vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://laragon.org/
Restart Required: No
Instructions:
1. Disable Simple Ajax Uploader plugin. 2. Remove file_upload.php example file. 3. Consider removing entire plugin directory.
🔧 Temporary Workarounds
Disable vulnerable plugin
allRemove or disable Simple Ajax Uploader plugin from Laragon installation
rm -rf /path/to/laragon/plugins/simple-ajax-uploader/
Restrict file uploads
allImplement strict file type validation and upload restrictions
🧯 If You Can't Patch
- Disable Simple Ajax Uploader plugin immediately
- Implement WAF rules to block requests to file_upload.php
🔍 How to Verify
Check if Vulnerable:
Check if /path/to/laragon/plugins/simple-ajax-uploader/file_upload.php exists and is accessibleCheck Version:
Not applicable - check plugin presence insteadVerify Fix Applied:
Confirm file_upload.php is removed and plugin directory no longer exists📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to file_upload.php
- File upload attempts with suspicious extensions
Network Indicators:
- Unusual outbound connections from web server
- Traffic to known malicious IPs
SIEM Query:
source="web_logs" AND (uri="/file_upload.php" OR file_upload.php)