CVE-2024-6084
📋 TL;DR
This critical vulnerability allows remote attackers to upload arbitrary files to the Pool of Bethesda Online Reservation System via the uploadImage function. Attackers can exploit this to upload malicious files like webshells, potentially gaining full control of affected systems. All users running versions up to 1.0 are affected.
💻 Affected Systems
- Pool of Bethesda Online Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Unauthorized file upload leading to webshell installation and server control
If Mitigated
File upload attempts blocked or quarantined with no system impact
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; simple file upload manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing with secure alternative software.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allBlock file uploads to vulnerable endpoint and restrict file types
File Upload Validation
allImplement server-side file type validation, size limits, and rename uploaded files
🧯 If You Can't Patch
- Block access to /admin/mod_room/controller.php at network perimeter
- Implement strict file upload validation and store uploaded files outside web root
🔍 How to Verify
Check if Vulnerable:
Test if you can upload arbitrary files (e.g., .php, .jsp) to /admin/mod_room/controller.php?action=addCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt file upload with malicious extensions; should be rejected with proper error📡 Detection & Monitoring
Log Indicators:
- File uploads to controller.php with unusual file extensions
- Multiple failed upload attempts
- Successful uploads of executable files
Network Indicators:
- POST requests to /admin/mod_room/controller.php?action=add with file uploads
- Subsequent requests to uploaded malicious files
SIEM Query:
source="web_server" AND (uri="/admin/mod_room/controller.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp"))