CVE-2024-1036
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to openBI systems due to insufficient validation in the Icon Handler component. Attackers can exploit this to upload malicious files like webshells, potentially leading to complete system compromise. All openBI installations up to version 1.0.8 are affected.
💻 Affected Systems
- openBI
📦 What is this software?
Openbi by Openbi
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, file manipulation, and potential privilege escalation.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Public exploit details available, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Upgrade to version above 1.0.8 if released, or apply workarounds.
🔧 Temporary Workarounds
Disable Icon Upload Functionality
allRemove or disable the uploadIcon function in Screen.php to prevent file uploads
# Comment out or remove uploadIcon function in /application/index/controller/Screen.php
Implement File Upload Restrictions
allAdd strict file type validation and size limits to the upload handler
# Add validation for allowed file extensions (e.g., only .png, .jpg, .ico)
# Implement file size limits and MIME type checking
🧯 If You Can't Patch
- Implement WAF rules to block suspicious file upload patterns
- Restrict network access to openBI instances using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check openBI version. If version <= 1.0.8 and Icon Handler is enabled, system is vulnerable.Check Version:
# Check openBI version in configuration files or admin panelVerify Fix Applied:
Test file upload functionality with malicious files. Successful upload indicates still vulnerable.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /application/index/controller/Screen.php
- Uploads of non-image files to icon handler
- Multiple failed upload attempts
Network Indicators:
- POST requests to uploadIcon endpoint with suspicious file types
- Unusual outbound connections after file uploads
SIEM Query:
source="openbi.log" AND (uri="/application/index/controller/Screen.php" OR method="POST") AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")