CVE-2024-4825

The vulnerability results from lack of proper verification of the type and content of uploaded files in the '/media/api' parameter handled by POST request (CWE-434: Unrestricted Upload of File with Dangerous Type). An attacker, without needing any privileges, can send a POST request containing a malicious file (e.g. webshell or other executable payload) directly to the vulnerable endpoint. The server accepts and saves the uploaded file without verifying its potentially dangerous nature.

An attacker can place malicious executable files on the server, which in practice enables remote code execution (RCE) and complete takeover of the server and entire infrastructure on which the application runs.

Apply patches available from the vendor according to the references. Additionally, it is recommended to restrict access to the '/media/api' endpoint at the firewall or network layer until the patch is deployed, as well as monitor the server for unauthorized files in publicly accessible directories.

Agentejo Cockpit CMS version 0.5.5