CVE-2024-7906
📋 TL;DR
This critical vulnerability in DedeBIZ 6.3.0 allows remote attackers to upload arbitrary files without restrictions via the get_mime_type function in the attachment settings component. This affects all DedeBIZ 6.3.0 installations with the vulnerable component enabled. Attackers can exploit this to upload malicious files and potentially execute arbitrary code on the server.
💻 Affected Systems
- DedeBIZ
📦 What is this software?
Dedebiz by Dedebiz
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell upload allowing persistent backdoor access, file system manipulation, and potential privilege escalation.
If Mitigated
File upload blocked or sanitized, preventing malicious file execution while maintaining legitimate attachment functionality.
🎯 Exploit Status
Exploit code has been publicly disclosed on GitHub. The vulnerability requires minimal technical skill to exploit due to unrestricted file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Restrict access to vulnerable component
allBlock or restrict access to /admin/dialog/select_images_post.php file
# Apache: RewriteRule ^admin/dialog/select_images_post\.php$ - [F,L]
# Nginx: location ~ ^/admin/dialog/select_images_post\.php$ { deny all; }
Implement file upload validation
allAdd server-side validation for file uploads including MIME type checking and file extension validation
# Example PHP validation snippet: if (!in_array($_FILES['upload']['type'], ['image/jpeg', 'image/png'])) { die('Invalid file type'); }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file upload patterns
- Disable file upload functionality entirely if not required for business operations
🔍 How to Verify
Check if Vulnerable:
Check if /admin/dialog/select_images_post.php exists and is accessible. Attempt to upload a non-image file with modified headers.Check Version:
Check DedeBIZ version in configuration files or admin panel. Look for version 6.3.0 in installation.Verify Fix Applied:
Test file upload functionality with various file types. Ensure only allowed file types are accepted and properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/dialog/select_images_post.php
- Uploads of non-image files with image MIME types
- Multiple failed upload attempts with different file types
Network Indicators:
- POST requests to vulnerable endpoint with unusual file payloads
- Uploads of executable files (.php, .exe) disguised as images
SIEM Query:
source="web_server" AND (uri="/admin/dialog/select_images_post.php" AND method="POST" AND (file_extension!="jpg" OR file_extension!="png" OR file_extension!="gif"))