CVE-2024-7904
📋 TL;DR
This critical vulnerability in DedeBIZ 6.3.0 allows remote attackers to upload arbitrary files without restrictions via the admin/file_manage_control.php component. Attackers can exploit this to upload malicious files like webshells, potentially gaining full control of affected systems. All DedeBIZ 6.3.0 installations with the vulnerable component exposed are affected.
💻 Affected Systems
- DedeBIZ
📦 What is this software?
Dedebiz by Dedebiz
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Webshell upload allowing unauthorized file system access, data exfiltration, and potential privilege escalation.
If Mitigated
Limited impact with proper file upload restrictions, web application firewalls, and network segmentation in place.
🎯 Exploit Status
Exploit code is publicly available, making attacks easy to automate. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Restrict File Upload Extensions
allModify admin/file_manage_control.php to only allow safe file extensions
Edit the PHP file to implement strict file type validation before upload processing
Disable Vulnerable Component
linuxRemove or restrict access to admin/file_manage_control.php
mv admin/file_manage_control.php admin/file_manage_control.php.disabled
chmod 000 admin/file_manage_control.php.disabled
🧯 If You Can't Patch
- Implement strict WAF rules to block file uploads to the vulnerable endpoint
- Network segmentation to isolate DedeBIZ systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check if admin/file_manage_control.php exists and is accessible. Test file upload functionality with restricted extensions.Check Version:
Check DedeBIZ version in configuration files or admin panelVerify Fix Applied:
Attempt to upload a file with a restricted extension (like .php) - should be rejected. Verify file upload restrictions are properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to admin/file_manage_control.php
- Uploads of executable files (.php, .exe, .sh)
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/file_manage_control.php with file uploads
- Unusual outbound connections from DedeBIZ server
SIEM Query:
source="web_logs" AND uri="/admin/file_manage_control.php" AND method="POST" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")