Cyber Resilience

CVE-2024-57408

HighPublic PoC

Published: 10 February 2025

Published
10 February 2025
Modified
22 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 51.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57408 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Beian.Miit Cool-Admin-Java. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57408 is an arbitrary file upload vulnerability in the /comm/upload component of cool-admin-java version 1.0. This flaw allows attackers to upload crafted files that enable arbitrary code execution. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 7.2.

Attackers require high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U), potentially allowing full system compromise through the executed code.

References include proof-of-concept exploits hosted on GitHub, such as those from kaoniniang2, alongside the official cool-admin-java repository, though specific patch or mitigation guidance is not detailed in the CVE publication dated 2025-02-10.

EU & UK References

Vulnerability details

An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing web component (/comm/upload) enables exploitation of public-facing applications (T1190) and deployment of web shells via crafted files for remote code execution (T1505.003).

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

beian.miit
cool-admin-java
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of identified software flaws, directly addressing the arbitrary file upload vulnerability in cool-admin-java to prevent exploitation and arbitrary code execution.

SI-10 Information Input Validation good match
prevent

Requires validation of information inputs at the /comm/upload endpoint to reject crafted dangerous files, comprehensively countering CWE-434 unrestricted upload.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection mechanisms at upload entry points to scan and eradicate crafted files enabling arbitrary code execution.

References