CVE-2024-58279
Published: 10 December 2025
Summary
CVE-2024-58279 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Apprain Apprain. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-58279 is an authenticated remote code execution vulnerability in appRain CMF 4.0.5. The flaw resides in the filemanager upload endpoint, which permits administrative users to upload malicious PHP files directly to the site's uploads directory, bypassing restrictions on dangerous file types (CWE-434). This issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to network accessibility and low privilege requirements.
Attackers with valid administrative credentials can exploit the vulnerability by crafting and uploading a malicious PHP file through the filemanager endpoint. Successful exploitation allows them to establish a web shell in the uploads directory, granting remote command execution on the server. This enables full compromise of the affected system, including data exfiltration, persistence, or further lateral movement.
Advisories and references, including the VulnCheck advisory on apprain-cmf authenticated RCE via filemanager upload and an Exploit-DB entry (52041) with proof-of-concept exploit code, document the issue. The appRain project site and GitHub archive for v4.0.5 provide additional context on the vulnerable version, though no specific patches or mitigations are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55319
Vulnerability details
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading…
more
a crafted PHP file to the site's uploads directory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated RCE via unrestricted file upload in a public-facing web app (T1190) directly facilitates deployment of a PHP web shell for remote command execution (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the flaw in the filemanager upload endpoint of appRain CMF 4.0.5 that permits unrestricted uploading of malicious PHP files leading to RCE.
Implements input validation mechanisms at the filemanager upload endpoint to detect and reject malicious PHP files, preventing exploitation of the unrestricted file upload vulnerability.
Enforces secure web server configuration settings to disable PHP execution in the uploads directory, blocking RCE even if malicious files are uploaded.