{"id":30228,"date":"2025-04-24T04:02:10","date_gmt":"2025-04-24T04:02:10","guid":{"rendered":""},"modified":"2025-05-07T06:01:18","modified_gmt":"2025-05-07T06:01:18","slug":"cve-2024-55372-unauthenticated-database-restoration-leading-to-arbitrary-file-upload-in-wallos","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-55372-unauthenticated-database-restoration-leading-to-arbitrary-file-upload-in-wallos\/","title":{"rendered":"CVE-2024-55372: Unauthenticated Database Restoration Leading to Arbitrary File Upload in Wallos<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In this post, we delve into a critical vulnerability, CVE-2024-55372, that affects the Wallos software version 2.38.2 and below. This vulnerability allows unauthenticated users to exploit a file upload flaw in the database restoration function, leading to potential system compromise and data leakage. Given Wallos’s wide use, this issue is of particular significance and requires immediate attention and mitigation.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2024-55372
\nSeverity: Critical (9.8 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise<\/a>, data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Wallos | <=2.38.2\n\nHow the Exploit Works<\/strong><\/p>\n

The vulnerability stems from Wallos’s restore<\/a> database function. This function permits unauthenticated users to upload a ZIP file<\/a>, which is then extracted on the server. By exploiting this feature, an attacker can upload a malicious ZIP file<\/a> containing a web shell, which is subsequently extracted and placed on the server. With a web shell in place, the attacker gains the ability to execute arbitrary<\/a> commands on the server, potentially leading to total system compromise and data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker might exploit this vulnerability with a carefully crafted HTTP POST<\/a> request, similar to the following:<\/p>\n

POST \/restore_database HTTP\/1.1\nHost: vulnerable-wallos-server.com\nContent-Type: application\/zip\nContent-Disposition: form-data; name=\"database\"; filename=\"malicious.zip\"\n<... binary data of the malicious ZIP file ...><\/code><\/pre>\n
In this request, the body contains the binary data of a ZIP file. This file includes a web shell, which, once extracted on the server, allows the attacker to execute arbitrary<\/a> commands. The server, not requiring authentication for the restore database function<\/a>, will process this request and extract the malicious file, thereby compromising its own security.<\/p>\n
Mitigation<\/strong><\/p>\n
As a mitigation measure, users are urged to apply the vendor patch as soon as it’s available. In the meantime, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can serve as temporary mitigation. These can be configured to block or alert on attempts to access the vulnerable<\/a> restore database function, particularly when the access attempts are not from trusted sources.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In this post, we delve into a critical vulnerability, CVE-2024-55372, that affects the Wallos software version 2.38.2 and below. This vulnerability allows unauthenticated users to exploit a file upload flaw in the database restoration function, leading to potential system compromise and data leakage. Given Wallos’s wide use, this issue is of particular significance and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-30228","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t