CVE-2024-52004

Insufficient input validation in MediaCMS allows remote code execution.

• CVSS 8.7
• CWE-74
• Input Validation and Sanitization
• Remote

MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.

CVE

CVE-2024-52004

CWE

CWE-74

CVSS base score

8.7

Published

2024-11-08

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MediaCMS

Solution

Upgrade to MediaCMS version 4.1.0 or later.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

# Example of a malicious Python script payload disguised as a video file
# This payload could be named "malicious.mp4" but actually contains Python code

import os
import subprocess

# This code would execute a command on the server
subprocess.call(["/bin/bash", "-c", "echo 'Malicious code executed' > /tmp/malicious.txt"])

@misc{vaitp:cve202452004,
  title        = {{Insufficient input validation in MediaCMS allows remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-52004},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-52004/}}
}