CVE-2024-24025
📋 TL;DR
An arbitrary file upload vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to upload malicious files by manipulating the filename parameter in the upload() function. This can lead to remote code execution or system compromise. All Novel-Plus instances running affected versions are vulnerable.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, data theft, or complete application takeover.
Likely Case
Webshell deployment leading to persistent access, data exfiltration, or lateral movement within the network.
If Mitigated
File uploads blocked or sanitized, limiting impact to denial of service or minor data exposure.
🎯 Exploit Status
Exploit requires crafting malicious filename parameter; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided
Restart Required: No
Instructions:
Upgrade to a patched version if available; otherwise apply workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation on filename parameter to block malicious extensions and paths.
Modify upload() function to validate file extensions and sanitize input.
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block requests with suspicious filename patterns.
Add WAF rule: Block requests containing '..', '/', '\', or executable extensions in filename parameter.
🧯 If You Can't Patch
- Disable file upload functionality entirely if not required.
- Restrict access to upload endpoint using network ACLs or authentication.
🔍 How to Verify
Check if Vulnerable:
Test by attempting to upload a file with a crafted filename (e.g., '../../malicious.jsp') and check if it's accepted.Check Version:
Check Novel-Plus version in application configuration or admin panel.Verify Fix Applied:
Verify that malicious filename uploads are rejected and only safe extensions are allowed.📡 Detection & Monitoring
Log Indicators:
- Log entries showing file uploads with suspicious filenames (e.g., containing '..', '/', or executable extensions).
Network Indicators:
- HTTP POST requests to upload endpoint with unusual filename parameters.
SIEM Query:
source="web_logs" AND uri="/upload" AND filename MATCHES "*..*|*/*|*.jsp|*.php|*.exe"