Detection Guidance

This vulnerability can be detected by checking for the presence of uploaded malicious ZIP files and extracted PHP shells on the server, especially through the vulnerable endpoint /filethingy/ft2.php.

You can attempt to detect if the exploit has been used by sending HTTP GET requests to potential locations of the uploaded PHP shell and observing the responses.

• Send a GET request to /filethingie/folders/tester/cmdshell.php with a command parameter, for example: GET /filethingie/folders/tester/cmdshell.php?cmd=whoami to check if the shell executes commands.
• Check for suspicious ZIP file uploads by monitoring POST requests to /filethingie/ft2.php containing ZIP files.
• Look for extracted PHP files in writable directories such as /tester or other accessible folders.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting the file upload and unzip functionality on the vulnerable endpoint /filethingie/ft2.php to prevent arbitrary file uploads.

Remove any suspicious uploaded ZIP files and extracted PHP shells from the server to eliminate existing backdoors.

Restrict write permissions on directories accessible by the web server to prevent extraction of malicious files.

Monitor web server logs for unusual POST requests uploading ZIP files and GET requests accessing suspicious PHP scripts.

Apply patches or upgrade FileThingie to a version that fixes this vulnerability once available.

Useful 0 Not Useful 0

Executive Summary

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious ZIP archives through the ft2.php endpoint.

Attackers can upload ZIP files containing PHP shells, then use the unzip functionality to extract these files into accessible directories on the server.

Once extracted, the attacker can execute arbitrary commands on the server by accessing the uploaded PHP shell scripts remotely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full remote code execution on the server hosting FileThingie.

• Attackers can run arbitrary system commands remotely.
• Sensitive files on the server, such as /etc/passwd, can be read by the attacker.
• The server and its data can be completely compromised, potentially leading to data theft, service disruption, or further attacks on connected systems.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0