CVE-2024-43033
Jpress ≤ 5.1.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-43033 is a high-severity Improper Handling of Windows ::DATA Alternate Data Stream (CWE-69) vulnerability in Jpress Jpress. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Fileless Storage (T1027.011); ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40021
Vulnerability Data
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement that recognizes all NTFS file access methods will block unauthorized use of ::$DATA streams.
Information-flow rules applied at the file-system level can treat ADS contents as distinct flows that must be authorized.
Review of file-access audit records can reveal creation or use of alternate data streams after the fact.
System monitoring configured to watch for ADS-specific file operations can surface hidden-stream activity.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring of runtime data and file activity directly detects or blocks hidden ADS usage.
Behavioral monitoring of technology usage may surface ADS anomalies as side effects.
Execution restrictions can block ADS-hidden binaries but do not address non-executable data streams.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging of file-system events can record ADS access attempts, aiding detection, but does not prevent the weakness itself.
Monitoring activities can flag anomalous ADS usage, providing partial mitigation through detection rather than prevention.
Secure-coding standards and reviews can require explicit handling or disabling of alternate data streams, directly addressing the root cause in application code.
Access-control rules can restrict which users or processes may read or write alternate data streams, but do not inherently detect or block ADS misuse.
Malware-protection mechanisms may scan or block known ADS-based threats, yet coverage is limited to signature or behavior heuristics rather than all ADS handling flaws.
Vulnerability-management processes can identify and patch OS or application weaknesses that permit ADS abuse, but do not directly address improper ADS handling in custom code.