BlogEngine.NET: Arbitrary File Upload Remote Code Execution (CVE-2023-33404)

BlogEngine.NET versions 3.3.8.0 and earlier contain an arbitrary file upload vulnerability (CVE-2023-33404) that facilitates remote code execution. The vulnerability resides within the application's API processing logic, specifically the /api/upload endpoint. An attacker holding the 'EditOwnPosts' permission can abuse this endpoint to upload malicious files. The application fails to properly validate the file type or path, instead saving the uploaded content to a hard-coded directory. Once the file is placed in this directory, an attacker can access the file via a standard HTTP request to trigger execution of the embedded code. This vulnerability is significant due to the availability of proof-of-concept exploit material, which increases the likelihood of exploitation against unpatched instances.

Attack Chain

1. Attacker authenticates to the BlogEngine.NET instance with at least 'EditOwnPosts' privileges.
2. Attacker initiates an HTTP POST request to the /api/upload endpoint with the parameter "action=video".
3. The application verifies the user's 'EditOwnPosts' permissions.
4. The application processes the request, utilizing the hard-coded directory path for storage.
5. The server-side UploadVideo function is invoked to handle the incoming file stream.
6. The application writes the malicious file to the filesystem, creating the target directory if it does not already exist.
7. Attacker makes a subsequent HTTP GET request to the path where the file was saved.
8. The web server executes the code contained within the uploaded file, resulting in full remote code execution.

Impact

Successful exploitation allows unauthenticated (post-authentication) attackers to gain remote code execution on the server hosting BlogEngine.NET. This grants the attacker the ability to interact with the underlying operating system, potentially leading to full system compromise, data exfiltration, or the deployment of additional malicious payloads.

Recommendation

1. Identify all instances of BlogEngine.NET running version 3.3.8.0 or earlier within the enterprise environment.
2. Monitor web access logs for POST requests to the /api/upload endpoint originating from user accounts with non-administrative, specific post-editing privileges.
3. Deploy the Sigma rule below to detect potential exploitation attempts targeting the file upload API.
4. Patch all BlogEngine.NET instances to a version later than 3.3.8.0 as soon as vendor updates become available.