CVE-2024-40548
📋 TL;DR
This vulnerability allows attackers to upload malicious files to the PublicCMS admin interface, leading to remote code execution. Any organization running PublicCMS v4.0.202302.e is affected. Attackers can gain full control of the server through this flaw.
💻 Affected Systems
- PublicCMS
📦 What is this software?
Publiccms by Publiccms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Webshell upload leading to website defacement, data exfiltration, and use as attack platform for further exploitation.
If Mitigated
Limited impact with proper file upload restrictions and admin interface isolation.
🎯 Exploit Status
Exploitation requires admin access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.202402.e or later
Vendor Advisory: https://gitee.com/sanluan/PublicCMS/issues/IAALCK
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Download latest version from official repository. 3. Replace affected files. 4. Restart web server. 5. Verify template upload restrictions are enforced.
🔧 Temporary Workarounds
Restrict admin interface access
allLimit access to /admin/ paths to trusted IP addresses only
# Apache: <Location /admin> Require ip 192.168.1.0/24 </Location>
# Nginx: location /admin { allow 192.168.1.0/24; deny all; }
Disable template upload functionality
linuxRemove or restrict the cmsTemplate/save endpoint
# Rename or remove the template upload directory
mv /path/to/publiccms/admin/cmsTemplate /path/to/publiccms/admin/cmsTemplate.disabled
🧯 If You Can't Patch
- Implement strict WAF rules to block file uploads to /admin/cmsTemplate/save
- Deploy file integrity monitoring on web directories and alert on unauthorized file changes
🔍 How to Verify
Check if Vulnerable:
Check if PublicCMS version is v4.0.202302.e and test if arbitrary files can be uploaded to /admin/cmsTemplate/save endpoint.Check Version:
Check PublicCMS version in admin dashboard or examine version files in installation directory.Verify Fix Applied:
Attempt to upload a non-template file (e.g., .php, .jsp) to the template endpoint - should be rejected with proper validation.📡 Detection & Monitoring
Log Indicators:
- File upload attempts to /admin/cmsTemplate/save with non-template extensions
- Unusual file creations in web-accessible directories
- Admin login from unexpected IP addresses
Network Indicators:
- POST requests to /admin/cmsTemplate/save with file uploads
- Subsequent requests to newly uploaded suspicious files
SIEM Query:
source="web_server" AND (uri="/admin/cmsTemplate/save" OR file_extension IN ("php", "jsp", "asp"))