CVE-2024-45171
📋 TL;DR
CVE-2024-45171 is an unrestricted file upload vulnerability in za-internet C-MOR Video Surveillance 5.2401 that allows authenticated users to upload arbitrary files, including PHP webshells, by naming files with '.cbkf' in the filename. This enables remote code execution on affected systems. All installations running vulnerable versions are affected.
💻 Affected Systems
- za-internet C-MOR Video Surveillance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell leading to data exfiltration, lateral movement, ransomware deployment, or persistent backdoor installation.
Likely Case
Attackers upload PHP webshells to gain remote code execution, steal surveillance footage, manipulate recordings, or use system as pivot point.
If Mitigated
With proper network segmentation and monitoring, impact limited to isolated surveillance system with no access to critical infrastructure.
🎯 Exploit Status
Exploitation is straightforward - authenticated user uploads file with .cbkf in filename and accesses via predictable URL path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check vendor for updates
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Contact za-internet for patch information 2. Apply vendor-provided update 3. Verify file upload restrictions are properly implemented
🔧 Temporary Workarounds
Restrict file upload directory permissions
linuxSet strict permissions on /srv/www/backups directory to prevent PHP execution
chmod 755 /srv/www/backups
chown root:root /srv/www/backups
find /srv/www/backups -name '*.php' -delete
Web server configuration to block PHP execution
linuxConfigure web server to deny execution of PHP files in backups directory
For Apache: Add 'php_flag engine off' to .htaccess in /backups directory
For Nginx: Add 'location ~ \.php$ { deny all; }' to backups location block
🧯 If You Can't Patch
- Disable or restrict access to backup upload functionality for low-privilege users
- Implement WAF rules to block file uploads with .cbkf.php patterns and monitor for suspicious upload attempts
🔍 How to Verify
Check if Vulnerable:
Check if running C-MOR 5.2401 and test if authenticated user can upload file with .cbkf.php extension via backup upload feature.Check Version:
Check C-MOR web interface admin panel or system information page for version number.Verify Fix Applied:
Attempt to upload test file with .cbkf.php extension - should be rejected or uploaded file should not be executable.📡 Detection & Monitoring
Log Indicators:
- File uploads to /backups/ directory with .cbkf in filename
- HTTP requests to /backup/upload_*.php patterns
- Unusual file creation in /srv/www/backups/
Network Indicators:
- POST requests to backup upload endpoints with PHP file content
- Subsequent GET requests to uploaded PHP files
SIEM Query:
source="web_logs" AND (uri_path="/backup/upload_*" AND method="POST") OR (uri_path="/backup/upload_*.php" AND method="GET")