CVE-2024-50648
📋 TL;DR
yshopmall V1.0 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files, potentially leading to remote code execution (RCE) and server takeover if the server is configured to parse JSP files. This affects all users running yshopmall V1.0 without proper security controls.
💻 Affected Systems
- yshopmall
📦 What is this software?
Yshopmall by Guchengwuyue
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise with administrative access, data exfiltration, and potential lateral movement within the network.
Likely Case
Remote code execution leading to web shell installation, data manipulation, and further exploitation of the server.
If Mitigated
File uploads blocked or properly validated, limiting impact to denial of service or unauthorized file storage.
🎯 Exploit Status
Public proof-of-concept available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict File Upload Types
allConfigure web server to only allow specific safe file extensions and block JSP/JSPX files.
# Configure in web.xml or application security settings
# Example: <security-constraint> with file extension restrictions
Disable JSP Execution
allConfigure application server to not execute JSP files from upload directories.
# In Tomcat: Add <security-constraint> to web.xml for upload directory
# Example: <url-pattern>/uploads/*</url-pattern> with no servlet mapping
🧯 If You Can't Patch
- Implement strict file type validation and whitelist allowed extensions
- Store uploaded files outside web root or in non-executable directories
🔍 How to Verify
Check if Vulnerable:
Test if you can upload a JSP file to the application and access it via URL. Check application version in admin panel or configuration files.Check Version:
# Check application version in admin interface or configuration files
# Look for version information in web.xml, pom.xml, or application.propertiesVerify Fix Applied:
Attempt to upload a JSP file - it should be rejected or stored in a non-executable location. Verify file upload restrictions are in place.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with JSP/JSPX extensions
- Multiple failed upload attempts followed by successful JSP upload
- Access to uploaded JSP files in web logs
Network Indicators:
- POST requests to file upload endpoints with JSP content
- Subsequent GET requests to uploaded JSP files
SIEM Query:
source="web_logs" AND (uri="/upload" OR uri="/file/upload") AND (extension="jsp" OR extension="jspx")