Attack Chain

1. An unauthenticated attacker sends an HTTP GET request to /upload/data/imgdb.db to download the database file.
2. The web server serves the imgdb.db file without authentication.
3. The attacker downloads the imgdb.db file.
4. The attacker deserializes or opens the database file to extract delete IDs. These IDs are stored in plaintext within the database.
5. The attacker crafts a malicious URL containing the d parameter and the extracted delete IDs, for example, index.php?d=delete_id_1,delete_id_2.
6. The attacker sends the crafted URL to the CF Image Hosting Script server via an HTTP GET request.
7. The server processes the request and deletes the images associated with the provided delete IDs.

Impact

Successful exploitation of this vulnerability leads to complete image deletion from the CF Image Hosting Script instance. There is no mention of the number of victims. The impact is high, potentially causing significant data loss and disruption of service for users relying on the image hosting. The vulnerability can be exploited remotely without authentication.

Recommendation

• Monitor web server access logs for requests to /upload/data/imgdb.db to detect unauthorized database downloads. Deploy the Sigma rule Detect Unauthorized Database Download to identify these events.
• Implement access controls to restrict direct access to the /upload/data/ directory via the webserver.
• Apply a web application firewall (WAF) rule to block requests containing the d parameter with suspicious delete IDs.
• Upgrade to a patched version of the CF Image Hosting Script or migrate to a different image hosting solution that addresses this vulnerability.