CVE-2024-55372: Unauthenticated Database Restoration Leading to Arbitrary File Upload in Wallos

Overview

In this post, we delve into a critical vulnerability, CVE-2024-55372, that affects the Wallos software version 2.38.2 and below. This vulnerability allows unauthenticated users to exploit a file upload flaw in the database restoration function, leading to potential system compromise and data leakage. Given Wallos’s wide use, this issue is of particular significance and requires immediate attention and mitigation.

Vulnerability Summary

CVE ID: CVE-2024-55372
Severity: Critical (9.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, data leakage

Affected Products

Product | Affected Versions

Wallos | <=2.38.2 How the Exploit Works

The vulnerability stems from Wallos’s restore database function. This function permits unauthenticated users to upload a ZIP file, which is then extracted on the server. By exploiting this feature, an attacker can upload a malicious ZIP file containing a web shell, which is subsequently extracted and placed on the server. With a web shell in place, the attacker gains the ability to execute arbitrary commands on the server, potentially leading to total system compromise and data leakage.

Conceptual Example Code

An attacker might exploit this vulnerability with a carefully crafted HTTP POST request, similar to the following:

POST /restore_database HTTP/1.1
Host: vulnerable-wallos-server.com
Content-Type: application/zip
Content-Disposition: form-data; name="database"; filename="malicious.zip"
<... binary data of the malicious ZIP file ...>

In this request, the body contains the binary data of a ZIP file. This file includes a web shell, which, once extracted on the server, allows the attacker to execute arbitrary commands. The server, not requiring authentication for the restore database function, will process this request and extract the malicious file, thereby compromising its own security.

Mitigation

As a mitigation measure, users are urged to apply the vendor patch as soon as it’s available. In the meantime, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can serve as temporary mitigation. These can be configured to block or alert on attempts to access the vulnerable restore database function, particularly when the access attempts are not from trusted sources.