{"id":30226,"date":"2025-04-24T03:01:42","date_gmt":"2025-04-24T03:01:42","guid":{"rendered":""},"modified":"2025-09-16T12:32:07","modified_gmt":"2025-09-16T18:32:07","slug":"cve-2024-55371-critical-file-upload-vulnerability-in-wallos-backup-restore-function","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-55371-critical-file-upload-vulnerability-in-wallos-backup-restore-function\/","title":{"rendered":"CVE-2024-55371: Critical File Upload Vulnerability in Wallos Backup Restore Function<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The cybersecurity community is currently facing a significant challenge with the discovery of a critical vulnerability, CVE-2024-55371, found in versions 2.38.2 and below of the Wallos software system. This vulnerability, which poses a severe threat to data integrity and system security, revolves around the software’s backup restore function. Authenticated users, even those without administrative privileges, can exploit this vulnerability by uploading<\/a> a ZIP file containing malicious files, potentially leading to system compromise or data leakage.
\nThe severity of this vulnerability is emphasized by its Common Vulnerability Scoring System<\/a> (CVSS) severity score of 9.8, signifying an urgent need for mitigation. This post provides an in-depth technical summary of the vulnerability<\/a>, its potential impact, and actionable mitigation strategies.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2024-55371
\nSeverity: Critical (CVSS: 9.8)
\nAttack Vector: Network
\nPrivileges Required: Low (Authenticated User<\/a>)
\nUser Interaction: Required
\nImpact: System Compromise<\/a>, Data Leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Wallos | <=2.38.2\n\nHow the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of the “restore backup”<\/a> function of Wallos. This function allows any authenticated user to upload and restore backups<\/a> via a ZIP file. The contents of the ZIP file are then extracted<\/a> directly on the server.
\nAn attacker can manipulate this functionality by injecting malicious files<\/a> into the ZIP file, such as a web shell. Once the web shell is uploaded and installed on the server, the attacker gains the ability to execute arbitrary<\/a> commands, potentially leading to full system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited<\/a>:<\/p>\n

POST \/backup_restore HTTP\/1.1\nHost: vulnerable-wallos-server.com\nContent-Type: application\/zip\n{ \"backup_file\": \"\" }<\/code><\/pre>\n
In the above example, the malicious_zip_file is a ZIP file containing the web shell or other malicious<\/a> payload. Once the file is uploaded and extracted on the server, the attacker can use the web shell to execute arbitrary commands<\/a>.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
The best course of action to mitigate the risk posed by this vulnerability<\/a> is to apply the vendor-supplied patch. If a patch is not immediately available or applicable, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation. These systems can help detect and prevent the uploading of malicious files<\/a>, reducing the risk of exploitation.
\nRemember, early detection and prompt action are crucial to maintaining a secure infrastructure in the face of emerging vulnerabilities<\/a> like CVE-2024-55371.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The cybersecurity community is currently facing a significant challenge with the discovery of a critical vulnerability, CVE-2024-55371, found in versions 2.38.2 and below of the Wallos software system. This vulnerability, which poses a severe threat to data integrity and system security, revolves around the software’s backup restore function. Authenticated users, even those without administrative […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-30226","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t