CVE-2024-55417
📋 TL;DR
CVE-2024-55417 allows authenticated users in DevDojo Voyager to bypass file type verification when uploading files via the media upload endpoint. This enables attackers to upload malicious files like web shells, leading to arbitrary code execution on the server. Only Voyager installations with authenticated user access are affected.
💻 Affected Systems
- DevDojo Voyager
📦 What is this software?
Voyager by Thecontrolgroup
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through web shell upload, allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Authenticated attacker uploads web shell, gains remote code execution, and compromises the application server.
If Mitigated
Attack prevented by proper file validation, leaving only failed upload attempts in logs.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.1 or later
Vendor Advisory: https://github.com/thedevdojo/voyager/security/advisories
Restart Required: No
Instructions:
1. Update Voyager to version 1.8.1 or later via composer update. 2. Verify the patch is applied by checking the VoyagerMediaController.php file.
🔧 Temporary Workarounds
Implement custom file validation middleware
allAdd server-side file type validation before processing uploads
Create custom middleware with strict MIME type and extension validation
Restrict upload directory permissions
linuxSet upload directory to read-only for web server user
chmod 755 /path/to/uploads
chown root:www-data /path/to/uploads
🧯 If You Can't Patch
- Disable the media upload functionality entirely via route middleware
- Implement WAF rules to block suspicious file uploads with .php, .phtml, .jsp extensions
🔍 How to Verify
Check if Vulnerable:
Check if Voyager version is 1.8.0 or earlier and if /admin/media/upload endpoint is accessibleCheck Version:
composer show thedevdojo/voyager | grep versionVerify Fix Applied:
Verify Voyager version is 1.8.1+ and test file upload with malicious extension is rejected📡 Detection & Monitoring
Log Indicators:
- Failed file upload attempts with unusual extensions
- Successful uploads of .php, .phtml, .jsp files to media directory
Network Indicators:
- POST requests to /admin/media/upload with executable file types
- Subsequent requests to uploaded suspicious files
SIEM Query:
source="web_logs" AND (uri_path="/admin/media/upload" AND (file_extension="php" OR file_extension="phtml" OR file_extension="jsp"))