CVE-2024-13138
Published: 05 January 2025
Summary
CVE-2024-13138 is a medium-severity Improper Access Control (CWE-284) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13138 is a critical vulnerability in wangl1989 mysiteforme version 1.0, affecting the upload function within the file src/main/java/com/mysiteform/admin/service/ipl/LocalUploadServiceImpl. The issue enables unrestricted file upload via manipulation of the "test" argument and can be triggered remotely.
Attackers with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in low impacts to confidentiality, integrity, and availability, as reflected in its CVSS 3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). It is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories and further details, including the publicly disclosed exploit, are available in the GitHub repository wangl1989/mysiteforme issue #55 and VulDB entries at ctiid.290212, id.290212, and submit.468511. The vulnerability was published on 2025-01-05T11:15:05.747, and the exploit may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51371
Vulnerability details
A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/java/com/mysiteform/admin/service/ipl/LocalUploadServiceImpl. The manipulation of the argument test leads to unrestricted upload. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted upload of dangerous files (e.g., JSP trojans, HTML) in a public-facing web app enables exploitation (T1190), web shell execution (T1100) and persistence (T1505.003), and staging tools/malware (T1608.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the manipulated 'test' argument and uploaded files to prevent unrestricted upload of dangerous types in LocalUploadServiceImpl.
Enforces approved authorizations to block improper access control exploitation allowing remote unrestricted file upload via the upload function.
Restricts classes of dangerous file types and parameters like 'test' to mitigate unrestricted uploads in the vulnerable service.