CVE-2024-8294
📋 TL;DR
This critical vulnerability in FeehiCMS allows remote attackers to upload arbitrary files without restrictions via the FriendlyLink[image] parameter. Attackers can potentially execute malicious code on affected systems. All FeehiCMS installations up to version 2.1.1 are vulnerable.
💻 Affected Systems
- FeehiCMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Webshell upload enabling unauthorized access, data manipulation, and further lateral movement within the network.
If Mitigated
File upload attempts blocked at WAF or detected by file integrity monitoring before execution.
🎯 Exploit Status
Exploit requires admin access to the vulnerable endpoint. Public disclosure increases weaponization likelihood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading if newer versions exist or implement workarounds.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file upload validation for the FriendlyLink[image] parameter
Modify /admin/index.php to validate file extensions, MIME types, and file signatures
Web Application Firewall Rules
allBlock malicious file upload attempts at the WAF layer
Add WAF rules to detect and block suspicious uploads to /admin/index.php?r=friendly-link%2Fupdate
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only
- Implement file integrity monitoring on upload directories and alert on unexpected file changes
🔍 How to Verify
Check if Vulnerable:
Check if FeehiCMS version is ≤2.1.1 and test file upload at /admin/index.php?r=friendly-link%2Fupdate with restricted file typesCheck Version:
Check CMS version in configuration files or admin dashboardVerify Fix Applied:
Attempt to upload restricted file types (e.g., .php, .jsp) and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/index.php?r=friendly-link%2Fupdate
- Execution of uploaded files in upload directories
Network Indicators:
- POST requests to vulnerable endpoint with file uploads
- Subsequent connections from uploaded files
SIEM Query:
source="web_logs" AND uri="/admin/index.php?r=friendly-link%2Fupdate" AND method="POST" AND file_upload="true"