CVE-2024-57408
Published: 10 February 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2024-57408 is an arbitrary file upload vulnerability in the /comm/upload component of cool-admin-java version 1.0. This flaw allows attackers to upload crafted files that enable arbitrary code execution. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 7.2.
Attackers require high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U), potentially allowing full system compromise through the executed code.
References include proof-of-concept exploits hosted on GitHub, such as those from kaoniniang2, alongside the official cool-admin-java repository, though specific patch or mitigation guidance is not detailed in the CVE publication dated 2025-02-10.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Arbitrary file upload vulnerability in public-facing web component (/comm/upload) enables exploitation of public-facing applications (T1190) and deployment of web shells via crafted files for remote code execution (T1505.003).