CVE-2024-9904
📋 TL;DR
This critical vulnerability in 07FLYCMS/07FlyCRM allows attackers to upload arbitrary files without restrictions via the pictureUpload function. Remote attackers can exploit this to upload malicious files like webshells or malware. All users running affected versions of 07FLYCMS, 07FLY-CMS, or 07FlyCRM are vulnerable.
💻 Affected Systems
- 07FLYCMS
- 07FLY-CMS
- 07FlyCRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Webshell installation allowing persistent backdoor access and further exploitation
If Mitigated
File uploads blocked or properly validated, limiting attack surface
🎯 Exploit Status
Exploit details publicly available on GitHub, simple file upload manipulation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading if vendor releases fix, otherwise implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests to /admin/File/pictureUpload endpoint
WAF-specific configuration required
File Upload Restriction
allImplement server-side file type validation and size limits
Application-specific code modifications required
🧯 If You Can't Patch
- Disable or restrict access to /admin/File/pictureUpload endpoint
- Implement strict file upload validation including file type checking, size limits, and content inspection
🔍 How to Verify
Check if Vulnerable:
Check if running 07FLYCMS/07FlyCRM version 1.2.0 or earlier and test file upload functionality at /admin/File/pictureUploadCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test if arbitrary file uploads are still possible after implementing controls📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/File/pictureUpload
- Uploads of non-image file types
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/File/pictureUpload with suspicious file extensions
- Unusual outbound connections after file uploads
SIEM Query:
source_ip=* AND uri_path="/admin/File/pictureUpload" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")