CVE-2024-1034
📋 TL;DR
This critical vulnerability in openBI allows attackers to upload arbitrary files without restrictions via the uploadFile function. This affects all openBI installations up to version 1.0.8 and can be exploited remotely without authentication.
💻 Affected Systems
- openBI
📦 What is this software?
Openbi by Openbi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution by uploading webshells or malicious scripts, leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Webshell upload leading to unauthorized access, data exfiltration, or server takeover.
If Mitigated
Limited impact if file uploads are disabled or strict file type validation is enforced.
🎯 Exploit Status
Exploit details are publicly disclosed; simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available; upgrade to a version above 1.0.8 if released, or apply workarounds.
🔧 Temporary Workarounds
Disable file upload functionality
allTemporarily disable the vulnerable uploadFile endpoint or restrict access to it.
# Modify /application/index/controller/File.php to comment out or remove uploadFile method
# Or use web server rules to block access to the endpoint
Implement strict file validation
allAdd server-side validation to restrict file types, extensions, and content.
# In uploadFile function, add checks for allowed extensions (e.g., only .jpg, .png)
# Validate MIME types and scan files for malicious content
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with rules to block malicious file uploads.
- Restrict network access to the openBI instance to trusted IPs only.
🔍 How to Verify
Check if Vulnerable:
Check openBI version; if ≤1.0.8, test by attempting to upload a file with a malicious extension (e.g., .php) to the upload endpoint.Check Version:
# Check openBI version in configuration files or via admin interfaceVerify Fix Applied:
After applying workarounds, test that file uploads are blocked or properly validated; verify version is >1.0.8 if patched.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /application/index/controller/File.php
- Uploads of executable files (e.g., .php, .jsp)
Network Indicators:
- HTTP POST requests to file upload endpoints with suspicious payloads
SIEM Query:
source="web_logs" AND uri="/application/index/controller/File.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp")