CVE-2024-13022
📋 TL;DR
This critical vulnerability in Tarzan CMS 1.0.0 allows remote attackers to upload arbitrary files without restrictions via the UploadResponse function in the article management component. Attackers can exploit this to upload malicious files like web shells, potentially gaining full control of affected systems. Any system running the vulnerable version is at risk.
💻 Affected Systems
- taisan tarzan-cms
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via web shell upload leading to data theft, ransomware deployment, or use as attack infrastructure
Likely Case
Unauthorized file upload leading to web shell installation and limited server compromise
If Mitigated
File upload attempts blocked or logged with no successful exploitation
🎯 Exploit Status
Exploit details publicly disclosed on Gitee issue tracker
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/taisan/tarzan-cms/issues/IBCUPG
Restart Required: Yes
Instructions:
1. Check vendor for official patch 2. Apply patch if available 3. Restart application server 4. Verify fix
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file upload requests to vulnerable endpoint
WAF specific - block POST requests to */admin/controller/common/UploadController*
File Upload Restriction
allImplement server-side file type validation and size limits
Application configuration - restrict allowed file extensions and implement virus scanning
🧯 If You Can't Patch
- Disable article upload functionality completely
- Implement network segmentation to isolate CMS from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if running tarzan-cms version 1.0.0 and test file upload endpoint for unrestricted uploadCheck Version:
Check application configuration or package manager for tarzan-cms versionVerify Fix Applied:
Attempt to upload restricted file types (e.g., .jsp, .php) and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/controller/common/UploadController
- Uploads of executable file types
- Multiple failed upload attempts
Network Indicators:
- POST requests to upload endpoint with suspicious file names
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_logs" AND uri="/admin/controller/common/UploadController" AND (file_extension="jsp" OR file_extension="php" OR file_extension="exe")