CVE-2024-23790

What it actually does

The vulnerability allows uploading files of arbitrary types through the avatar upload functionality because filetype validation is missing, enabling misuse of the upload feature.

Why it matters to the business

Attackers can upload malicious files to the system, potentially leading to unauthorized code execution or data compromise, increasing risk of breaches and operational disruption.

How an attack unfolds

An attacker crafts a request to the avatar upload endpoint, providing a file with a disallowed extension or type that bypasses the absent checks, allowing the file to be stored and potentially executed or misused.

How to fix it

Upgrade affected OTRS installations to versions after 7.0.48, 8.0.37 or 2023.1.1. For Streampark apply commit c3c468c9192dd87b4ae430a41735bde7a391dfba to enforce proper filetype validation on uploads.

How to confirm the fix worked

Confirm filetype allow-list enforcement is present in upload handlers, then test uploads using disallowed extensions and verify they are rejected before storage.

Typical attack path

1. Identify publicly reachable instance with avatar upload feature
2. Send unauthenticated HTTP POST to the upload endpoint
3. Attach file payload using disallowed filetype or extension
4. Bypass missing validation allowing storage of the file
5. Trigger or reference the uploaded file to achieve code execution or other misuse

How to detect it

Inspect web server and application logs for POST requests to avatar upload paths containing unexpected file extensions or MIME types that should have been rejected.

What your security team should do

• Prioritize upgrade to fixed versions given critical CVSS score
• Add web application firewall rules blocking suspicious upload content types
• Enable detailed logging of all avatar upload attempts for review