CVE-2024-55371
📋 TL;DR
Wallos versions up to 2.38.2 contain a file upload vulnerability in the restore backup function that allows authenticated users to upload malicious ZIP files. When extracted on the server, these files can lead to remote code execution via web shells. Any Wallos installation with authenticated users is affected.
💻 Affected Systems
- Wallos
📦 What is this software?
Wallos by Wallosapp
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized file upload leading to web shell deployment and limited command execution.
If Mitigated
File upload blocked or sanitized, preventing malicious content execution.
🎯 Exploit Status
Exploitation requires authenticated access and involves uploading a malicious ZIP file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 2.38.2
Vendor Advisory: https://github.com/ellite/Wallos/releases
Restart Required: No
Instructions:
1. Update Wallos to version > 2.38.2. 2. Follow vendor release notes for any additional steps.
🔧 Temporary Workarounds
Disable Backup Restore Function
allTemporarily disable the restore backup functionality to prevent file uploads.
Modify Wallos configuration or code to remove/disable restore backup feature.
Restrict File Uploads
allImplement server-side file validation to block ZIP files or restrict uploads to trusted sources.
Configure web server (e.g., Apache/Nginx) to reject .zip uploads or use WAF rules.
🧯 If You Can't Patch
- Restrict access to Wallos to trusted users only and monitor for suspicious activity.
- Implement network segmentation to isolate Wallos from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check Wallos version; if <= 2.38.2, it is vulnerable.Check Version:
Check Wallos admin panel or configuration files for version number.Verify Fix Applied:
Verify Wallos version is > 2.38.2 and test restore backup function with safe files.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to backup restore endpoint, unexpected ZIP file extractions.
Network Indicators:
- HTTP POST requests to backup restore URLs with ZIP payloads.
SIEM Query:
source="wallos_logs" AND (url="*restore*" OR file_extension=".zip")