Critical ShowDoc RCE Vulnerability CVE-2024-XXXX Actively Exploited

Key Takeaways

• A critical remote code execution (RCE) vulnerability in ShowDoc, identified as CNVD-2020-26585, is under active exploitation.
• The flaw allows unauthenticated attackers to upload malicious files and execute arbitrary code on vulnerable servers.
• ShowDoc versions prior to 2.8.7 are susceptible to this unauthenticated file upload vulnerability.
• The vulnerability poses a significant risk due to ShowDoc’s role in housing sensitive internal documentation and API specifications.
• An official patch is available in ShowDoc version 2.8.7 and later, and immediate upgrade is strongly recommended.

A severe security vulnerability affecting ShowDoc, a widely adopted online platform for document sharing and collaboration among IT professionals globally, is currently being actively exploited by malicious actors. This critical flaw, designated CNVD-2020-26585, enables unauthorized remote attackers to upload harmful files and subsequently execute arbitrary code on compromised servers without needing any prior authentication.

Given that ShowDoc installations frequently store highly sensitive internal documentation and critical API specifications, a successful breach leveraging this vulnerability could provide attackers with a substantial foothold within an organization’s internal network infrastructure.

ShowDoc RCE Vulnerability Details

The root cause of this vulnerability lies in an unrestricted file upload mechanism present in ShowDoc versions preceding 2.8.7. Specifically, the issue originates from how the application handles incoming file uploads via its image upload API endpoint.

Threat actors can completely circumvent standard security filters, delivering a malicious payload directly to the server infrastructure without requiring any prior authentication or system privileges.

Researchers from the Vulhub project have demonstrated that exploiting this vulnerability requires only a single, carefully constructed HTTP POST request. By targeting the /index.php?s=/home/page/uploadImg endpoint, attackers can trick the server into accepting executable PHP scripts instead of legitimate image formats.

The exploit sequence involves several key steps:

• Attackers manipulate the content disposition header by injecting specific characters into the filename, such as test.<>php, to bypass basic extension validation mechanisms.
• A simple webshell or a PHP execution command is embedded directly within the raw text of the uploaded multipart form data.
• Upon successful processing of the malicious request by the server, it responds with the direct URL to the newly uploaded PHP file.
• Accessing this generated URL triggers the execution of the injected script with the privileges of the web server, thereby granting the attacker full remote code execution capabilities.

Organizations that rely on ShowDoc must take immediate and decisive action to secure their documentation environments against this ongoing threat. The widespread availability of exploit code makes unpatched servers easy targets for automated scanning and attacks, as detailed in reports by security researchers.

What You Should Do

• Administrators must promptly upgrade their ShowDoc instances to version 2.8.7 or later to apply the official security patch that addresses this critical flaw.
• Security teams should meticulously review web server access logs for any suspicious POST requests specifically targeting the image upload directory.
• Network defenders are advised to restrict access to internal documentation servers, ensuring they are not directly exposed to the public internet.
• Organizations should configure Web Application Firewalls (WAFs) to inspect incoming traffic and actively block malformed file upload requests that contain executable script extensions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.