CVE-2024-31777
Published: 13 June 2024
Summary
CVE-2024-31777 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Openeclass Openeclass. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-31777 is an unrestricted file upload vulnerability, tracked under CWE-434, that affects the openeclass learning management platform in version 3.15 and earlier. The flaw resides in the certbadge.php endpoint and permits an unauthenticated remote attacker to supply a crafted file that results in arbitrary code execution on the server.
The CVSS 9.8 vector indicates the issue is exploitable over the network with low attack complexity and without requiring credentials or user interaction. An attacker can therefore upload and execute malicious code, achieving full confidentiality, integrity, and availability impact on the affected installation.
Public exploit code targeting the vulnerability has been published on GitHub. The current EPSS score of 0.3039 matches the observed peak, indicating sustained exploitation interest since disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29650
Vulnerability details
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unrestricted file upload vulnerability in the Open eClass web application (certbadge.php endpoint) enables remote code execution for authenticated administrators by uploading crafted ZIP files containing web shells, mapping to exploitation of public-facing applications (T1190) and web shell deployment/execution (T1100, T1505.003).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.