CVE-2024-13134
📋 TL;DR
This critical vulnerability in ZeroWdd studentmanager 1.0 allows remote attackers to upload arbitrary files via the addTeacher/editTeacher functions. Attackers can exploit this to upload malicious files like webshells or malware. Anyone running the vulnerable studentmanager software is affected.
💻 Affected Systems
- ZeroWdd studentmanager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell upload leading to remote code execution, data theft, and lateral movement within the network.
Likely Case
Attackers upload webshells to gain persistent access, deface websites, or deploy ransomware on the server.
If Mitigated
File uploads are blocked or properly validated, preventing malicious file execution.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. Attack requires access to teacher management functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Consider implementing file upload validation or replacing the software.
🔧 Temporary Workarounds
Implement file upload validation
allAdd server-side validation to restrict uploaded file types to safe extensions only.
Modify TeacherController.java to validate file extensions before saving
Disable file upload functionality
allTemporarily disable teacher file upload features in the application.
Comment out or remove file upload code in TeacherController.java
🧯 If You Can't Patch
- Implement WAF rules to block malicious file uploads
- Restrict network access to the application using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if running studentmanager 1.0 and examine TeacherController.java for missing file upload validation.Check Version:
Check application version in configuration files or about page.Verify Fix Applied:
Test file upload functionality with malicious file extensions to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to teacher directories
- Files with suspicious extensions (.jsp, .php, .exe) in upload directories
Network Indicators:
- HTTP POST requests to teacher upload endpoints with unusual file types
SIEM Query:
source="web_server" AND (uri="/teacher/upload" OR uri="/teacher/add") AND file_extension IN ("jsp", "php", "exe", "war")