Executive Summary

CVE-2021-47936 is a critical remote code execution vulnerability in OpenCATS version 0.9.4 and earlier. It allows unauthenticated attackers to upload malicious PHP files disguised as resume attachments through the careers job application endpoint.

Once the malicious PHP file is uploaded, attackers can execute arbitrary system commands by sending POST requests to the uploaded file in the upload directory, effectively gaining control over the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on your server running OpenCATS 0.9.4 or earlier.

• Attackers can execute arbitrary system commands without authentication.
• Compromise of the server hosting the OpenCATS application.
• Potential data breaches or loss of sensitive recruitment data.
• Disruption of recruitment operations and damage to organizational reputation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious PHP files uploaded through the careers job application endpoint, especially in the upload directory where resume attachments are stored.

You can look for suspicious PHP files disguised as resume attachments and attempt to interact with them via POST requests to see if arbitrary commands can be executed.

A practical approach is to scan the upload directory for unexpected PHP files using commands like:

• find /path/to/opencats/upload/directory -type f -name "*.php"
• grep -r --include="*.php" "system\|exec\|shell_exec\|passthru" /path/to/opencats/upload/directory

Additionally, monitoring HTTP POST requests to uploaded PHP files in the upload directory can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Restrict or disable the ability to upload PHP files through the careers job application endpoint.
• Implement strict file type validation and sanitization on uploaded resume attachments to prevent PHP payloads.
• Apply authentication controls to the upload functionality to prevent unauthenticated access.
• Remove any suspicious PHP files found in the upload directory.
• Update OpenCATS to a version later than 0.9.4, such as the latest release 0.9.7.4, which includes security fixes.

Monitoring logs for unusual POST requests to uploaded files and restricting web server execution permissions in the upload directory can also help mitigate exploitation.

Useful 0 Not Useful 0