Arbitrary File Upload in Redsea Cloud eHR Leading to RCE

Executive Summary

CVE-2024-14037 is an arbitrary file upload vulnerability in Redsea Cloud eHR. It allows unauthenticated attackers to upload malicious files, specifically JSP webshells, through the PtFjk.mob servlet endpoint.

Attackers bypass file extension and MIME type validation by spoofing the Content-Type as image/jpeg in a multipart POST request. The malicious file is stored in a predictable directory and executed directly by the web server, enabling remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on the affected server without any authentication, allowing attackers to execute arbitrary commands.

Successful exploitation can result in full system compromise, unauthorized access to sensitive data, disruption of services, and potential control over the entire application environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious HTTP POST requests to the PtFjk.mob servlet endpoint, especially multipart/form-data uploads containing files with spoofed Content-Type headers such as image/jpeg but containing JSP code.

Detection can include searching web server logs for POST requests to paths like /RedseaPlatform/PtFjk.mob?method=upload or similar endpoints, and checking for uploaded files in the uploadfile directory with unexpected extensions or contents.

Commands to help detect this activity might include:

• Using grep or similar tools to find suspicious POST requests in web server logs, e.g., `grep 'POST /RedseaPlatform/PtFjk.mob' /var/log/httpd/access_log`
• Searching for files with JSP content in the uploadfile directory, e.g., `find /path/to/uploadfile -type f -exec grep -l '<%=' {} +`
• Monitoring network traffic for multipart POST requests with Content-Type spoofing, possibly using tools like Wireshark or tcpdump with filters for HTTP POST and Content-Type headers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict validation on uploaded files both on the client and server side.

• Enforce file type validation by checking file extensions and MIME types to block executable scripts like JSP.
• Rename uploaded files to prevent execution of malicious scripts.
• Restrict upload directories from executing files by setting appropriate permissions.
• Limit file size and use whitelist mechanisms to allow only safe file types.
• Perform content inspection on uploaded files to detect malicious code.
• Hide or obfuscate upload paths to reduce predictability.

Additionally, applying any available patches or updates from the vendor is critical to fully remediate the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to upload arbitrary malicious files and achieve remote code execution on the affected system. This can lead to unauthorized access, data breaches, and potential manipulation or exposure of sensitive personal or health information.

Such security weaknesses can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require organizations to protect personal and health data against unauthorized access and ensure the integrity and confidentiality of such data.

Failure to address this vulnerability could lead to violations of these regulations, potentially resulting in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0