CVE-2024-55371

The backup restore function accepts a ZIP file uploaded by the user and automatically extracts its contents on the server without proper verification of uploaded files. An attacker can place a malicious file (e.g., PHP web shell) in the ZIP archive, which is saved in an accessible location on the server after extraction. Once the web shell is on the server, the attacker gains the ability to remotely execute arbitrary system commands (RCE). To carry out the attack, it is sufficient to have any user account in the application — administrator privileges are not required.

An attacker can gain full control over the server by executing arbitrary system commands, leading to complete compromise of data and system confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. Additionally, it is recommended to restrict access to the backup restore functionality and monitor user activity in the application.

Wallosapp Wallos version 2.38.2 and all earlier versions