CVE-2024-13144
Published: 06 January 2025
Summary
CVE-2024-13144 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zhenfeng13 My-Blog. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13144 is a vulnerability classified as critical in zhenfeng13 My-Blog 1.0, affecting the uploadFileByEditomd function within the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The issue stems from manipulation of the editormd-image-file argument, enabling unrestricted file upload (CWE-284, CWE-434). It has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-06.
A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation allows arbitrary file uploads, potentially compromising confidentiality, integrity, and availability to a low degree. The exploit has been disclosed publicly and may be used.
Advisories and discussions on mitigation are available in GitHub issues such as https://github.com/ZHENFENG13/My-Blog/issues/140 and VulDB entries including https://vuldb.com/?id.290232.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51377
Vulnerability details
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in a public-facing web app directly enables remote exploitation for initial access (T1190) and deployment of web shells (T1505.003) for execution/persistence.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents exploitation by validating the content, type, and format of files uploaded via the editormd-image-file argument in the vulnerable uploadFileByEditomd function.
Restricts file uploads to the BlogController endpoint to only permitted types and formats, blocking unrestricted arbitrary file uploads.
Mandates remediation of the specific flaw in src/main/java/com/site/blog/my/core/controller/admin/BlogController.java through patching or code correction.