CVE-2024-52302

HIGH

common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-52302 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit and 2 repository PoCs.

Description

common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper validation or restrictions, enabling attackers to upload malicious files that can lead to Remote Code Execution (RCE).

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
2

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 14, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Java-springboot-codebase

Browse OsamaTaher / Java-springboot-codebase
CVE List< 204402bb8b68030c14911379ddc82cfff00b8538affected

Proofs of concept

3

Catalogued exploits

ExploitDBSpring Boot common-user-management 0.1 - Remote Code Execution (RCE)ExploitDB exploitby d3scaNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubpream-totaram/CVE-2024-52302-reproductionRepository PoCby pream-totaram0Scanner12 files

25.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Spring Boot application that exposes an unvalidated file upload endpoint at payload withheld. It accepts a multipart file and writes it directly to /tmp/ using the original filename, demonstrating the vulnerable endpoint but containing no code to exploit it or generate a malicious payload.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (mvnw.cmd, pom.xml, CustomerController.java, DemoApplication.java) constitute a standard Spring Boot application with a known unrestricted file upload vulnerability (CVE-2024-52302). The code directly implements the described vulnerability without any concealed backdoor, deceptive payload, or operator-directed harm. The unreviewed binary file 'mvnw' is a standard Maven wrapper and its metadata-only exclusion is a limitation, but the supplied text evidence shows no backdoor behavior.

ClassificationScanner
Model confidence95%
AuthenticationUnknown
LanguagesJava
Target softwarecommon-user-management
Attack typesUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code implements the vulnerable endpoint described in CVE-2024-52302 but does not include any exploit payload, attack script, or logic to trigger remote code execution. It only provides the vulnerable application itself, which serves as a target for testing or scanning, not an active exploit.

src/main/java/com/boxing/demo/CustomerController.java:24-31

Requirements

  • The vulnerable endpoint payload withheld must be accessible over the network.src/main/java/com/boxing/demo/CustomerController.java:24-25

Observed behavior

  • The application accepts a multipart file upload via POST to payload withheld.src/main/java/com/boxing/demo/CustomerController.java:24-25
  • The uploaded file is saved to /tmp/ using the original filename without any validation or sanitization.src/main/java/com/boxing/demo/CustomerController.java:27-29
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Endpoint
Payload withheldThe endpoint accepts file uploads without validation, matching the described CVE-2024-52302 vulnerability.src/main/java/com/boxing/demo/CustomerController.java:24-31
Review boundaries

What the analysis did not establish

  • One binary file (mvnw) was flagged but not analyzed; it is a Maven wrapper script and unlikely to contain exploit logic.
  • Only 4 of 12 text files were included; the remaining 8 files are omitted and may contain additional context.
  • The evidence does not include any configuration files (e.g., application.properties) that might show authentication or security settings.
  • One binary file (mvnw, 11790 bytes) was flagged as metadata-only and not analyzed. Its contents could theoretically contain a backdoor, but the associated mvnw.cmd script is a standard Apache Maven Wrapper script and no evidence suggests the binary is malicious.
  • Eight text files were omitted from the evidence packet due to size constraints, so their contents were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubd3sca/CVE-2024-52302Repository PoCby d3sca1Not analyzed2 files

4.7 KiB

GitHub
PoC details

References

2