CVE-2024-10420
📋 TL;DR
This critical vulnerability in SourceCodester Attendance and Payroll System 1.0 allows remote attackers to upload arbitrary files via the /marimar/guest/update.php endpoint. Attackers can exploit this to upload malicious files like webshells, potentially leading to complete system compromise. Organizations using this specific software version are affected.
💻 Affected Systems
- SourceCodester Attendance and Payroll System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover via webshell upload leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Unauthorized file upload leading to webshell installation, allowing attackers to execute arbitrary commands and maintain persistent access.
If Mitigated
File upload attempts are blocked or logged, preventing successful exploitation while allowing detection of attack attempts.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative solutions.
🔧 Temporary Workarounds
Restrict File Upload Types
allImplement server-side validation to only allow specific file types (e.g., .jpg, .png) and verify file signatures.
Modify upload.php to include: $allowed_types = ['image/jpeg', 'image/png'];
Add MIME type verification and file extension validation.
Disable Guest Update Functionality
allTemporarily disable or restrict access to the vulnerable /marimar/guest/update.php endpoint.
Add .htaccess rule: Deny from all
Comment out or remove the upload functionality in update.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file uploads to the vulnerable endpoint.
- Isolate the system from internet access and restrict internal network access to only necessary users.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .txt) to /marimar/guest/update.php with image parameter. If successful, system is vulnerable.Check Version:
Check software version in admin panel or review source code for version markers.Verify Fix Applied:
Test file upload with same method; successful upload should be blocked with proper error messages.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /marimar/guest/update.php
- POST requests with file uploads containing non-image extensions
- Multiple failed upload attempts
Network Indicators:
- HTTP POST traffic to vulnerable endpoint with file uploads
- Unusual outbound connections from web server after upload
SIEM Query:
source="web_logs" AND uri="/marimar/guest/update.php" AND method="POST" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")