Unrestricted Upload of File with Dangerous Type (CWE-434)
A vulnerability has been identified in the Scriptcase application version 9.4.019. This vulnerability allows for the arbitrary upload of files via the /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ path using a POST request. The application fails to properly verify user input, potentially allowing an attacker to upload malicious files to the server.
This vulnerability has a severe impact potential. With a CVSS v3.1 base score of 9.8 (Critical), it affects all three core aspects of information security: 1. Confidentiality: High impact - An attacker could potentially access sensitive information on the server. 2. Integrity: High impact - The ability to upload arbitrary files could allow an attacker to modify or replace existing files on the server. 3. Availability: High impact - Malicious file uploads could be used to disrupt normal server operations or execute denial-of-service attacks. The attack vector is network-based, requires no user interaction, and can be executed without any privileges, making it relatively easy for attackers to exploit. The scope is unchanged, indicating that the vulnerability affects resources within its security scope.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
As of the provided information, there is no mention of an available patch. The vulnerability is reported for Scriptcase version 9.4.019, but there's no information about fixes in newer versions. It is recommended to check with the Scriptcase vendor for any security updates or patches that may have been released since this vulnerability was reported.
While awaiting a patch from the vendor, consider the following mitigation strategies: 1. Implement strict file upload restrictions, including file type verification, size limits, and content validation. 2. Use a Web Application Firewall (WAF) to filter and monitor HTTP traffic to the Scriptcase application. 3. Restrict access to the vulnerable path (/scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/) if it's not essential for operations. 4. Regularly monitor and audit file uploads and server activities for any suspicious behavior. 5. If possible, consider temporarily disabling file upload functionality until a patch is available. 6. Ensure that the server running Scriptcase has up-to-date security measures and that file permissions are properly configured to minimize potential damage from uploaded files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-8940. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8940
A CVSS base score of 10 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 9.6%)
CVE-2024-8940 is a critical vulnerability in Scriptcase application version 9.4.019, with a CVSS score of 9.9, that allows attackers to exploit an arbitrary file upload via a POST request, potentially leading to the upload of malicious files to the server. The provided information does not indicate whether this vulnerability is being actively exploited in the wild, nor does it mention any proof-of-concept exploits, mitigations, detections, or patches. There is also no information regarding downstream impacts on other third-party vendors or technologies. See article
A CVSS base score of 9.8 has been assigned.