CVE-2024-35079
📋 TL;DR
This vulnerability allows attackers to upload malicious .jsp files through the uploadAudio method in inxedu v2024.4, leading to arbitrary code execution on the server. Any organization running the vulnerable version of inxedu is affected, potentially enabling complete system compromise.
💻 Affected Systems
- inxedu
📦 What is this software?
Inxedu by Inxedu
⚠️ Risk & Real-World Impact
Worst Case
Full server takeover with administrative privileges, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Webshell installation leading to persistent backdoor access, data theft, and further exploitation of the compromised system.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls blocking malicious uploads.
🎯 Exploit Status
Simple file upload exploitation with publicly available proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.inxedu.com/
Restart Required: No
Instructions:
Check vendor website for security updates. If patch unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Restrict File Upload Extensions
allConfigure web server to block .jsp file uploads and only allow audio file extensions
# Configure in web application or web server (e.g., Apache/Nginx) to reject .jsp uploads
Implement File Upload Validation
allAdd server-side validation to check file content type and extension
# Add validation in uploadAudio method to verify file is actual audio format
🧯 If You Can't Patch
- Disable uploadAudio functionality completely if not required
- Implement Web Application Firewall (WAF) rules to block .jsp file uploads
🔍 How to Verify
Check if Vulnerable:
Check if running inxedu v2024.4 and test uploadAudio endpoint with .jsp fileCheck Version:
# Check inxedu version in application configuration or admin panelVerify Fix Applied:
Attempt to upload .jsp file after implementing controls - should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual .jsp file uploads to uploadAudio endpoint
- Multiple failed upload attempts with non-audio extensions
Network Indicators:
- POST requests to uploadAudio with .jsp files
- Subsequent suspicious outbound connections from server
SIEM Query:
source="web_logs" AND uri="/uploadAudio" AND file_extension=".jsp"