CVE-2024-46101
📋 TL;DR
GDidees CMS v3.9.1 and earlier contains an unrestricted file upload vulnerability that allows attackers to upload malicious files, including webshells, to the server. This affects all websites running vulnerable versions of GDidees CMS, potentially leading to complete system compromise.
💻 Affected Systems
- GDidees CMS
📦 What is this software?
Gdidees Cms by Gdidees
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full server takeover, data exfiltration, and lateral movement within the network
Likely Case
Webshell deployment allowing persistent backdoor access, file manipulation, and credential theft
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls in place
🎯 Exploit Status
Simple HTTP POST requests with malicious file uploads can exploit this vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.9.2 or later
Vendor Advisory: https://github.com/N0zoM1z0/MY-CVE/blob/main/CVE-2024-46101.md
Restart Required: No
Instructions:
1. Download latest version from official GDidees CMS repository
2. Backup current installation
3. Replace all files with patched version
4. Verify file upload functionality is properly restricted
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file type validation and extension filtering
# Add to .htaccess or web server config
<FilesMatch "\.(php|phtml|php3|php4|php5|phps|phar|inc|pl|py|jsp|asp|aspx|sh|bash|cmd|bat)$">
Order Allow,Deny
Deny from all
</FilesMatch>
Web Application Firewall
allDeploy WAF rules to block malicious file uploads
# Example ModSecurity rule
SecRule FILES_TMPNAMES "@rx \.(php|phtml|php3|php4|php5|phps|phar|inc|pl|py|jsp|asp|aspx|sh|bash|cmd|bat)$" "id:1001,phase:2,deny,msg:'Malicious file upload attempt'"
# Cloudflare WAF rule: Block file uploads with dangerous extensions
🧯 If You Can't Patch
- Disable all file upload functionality in GDidees CMS
- Implement network segmentation to isolate GDidees CMS server from critical systems
🔍 How to Verify
Check if Vulnerable:
Check GDidees CMS version in admin panel or by examining version files. Attempt to upload a file with dangerous extension (e.g., test.php) - if accepted without validation, system is vulnerableCheck Version:
# Check version in admin panel or look for version.txt file
cat /path/to/gdidees/version.txtVerify Fix Applied:
After patching, attempt to upload malicious file types - they should be rejected with proper error messages📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with dangerous extensions
- Multiple failed upload attempts followed by successful upload
- POST requests to upload endpoints with suspicious filenames
Network Indicators:
- HTTP POST requests to /upload or similar endpoints with executable file content
- Subsequent connections to uploaded malicious files
SIEM Query:
source="web_server" (method="POST" AND uri="*upload*" AND (filename="*.php" OR filename="*.jsp" OR filename="*.asp" OR filename="*.sh"))