CVE-2024-13212
Published: 09 January 2025
Summary
CVE-2024-13212 is a medium-severity Improper Access Control (CWE-284) vulnerability in Singmr Houserent. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13212 is a critical vulnerability in SingMR HouseRent 1.0, affecting the singleUpload/upload function within the file src/main/java/com/house/wym/controller/AddHouseController.java. The issue arises from unrestricted file upload due to manipulation of the 'file' argument, as classified under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-09.
The vulnerability can be exploited remotely by an authenticated attacker with low privileges (PR:L), requiring no user interaction and only low attack complexity over the network. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through unrestricted file uploads, potentially enabling attackers to upload malicious files to the server.
Advisories and references, including GitHub issues at https://github.com/SingMR/HouseRent/issues/13 and VulDB entries (e.g., https://vuldb.com/?ctiid.290817), document the vulnerability. The exploit has been publicly disclosed and may be used, with no specific patches or mitigations detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51433
Vulnerability details
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload vulnerability in a public-facing web application directly enables remote exploitation (T1190) and deployment of malicious server-side components such as web shells (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses unrestricted file upload by requiring validation of the 'file' argument's type, content, and safety in the singleUpload/upload function.
Enforces access control policies to restrict the AddHouseController upload function, countering CWE-284 improper access control for dangerous files.
Requires timely identification and remediation of the specific flaw in src/main/java/com/house/wym/controller/AddHouseController.java enabling unrestricted uploads.