Advantive VeraCore Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2024-57968) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-57968) is a high-severity arbitrary file upload vulnerability (CWE-434) in the Advantive VeraCore logistics and fulfillment platform. The root cause lies in the insufficient validation of file paths and extensions within the upload.aspx endpoint. This flaw allows authenticated remote users to bypass directory restrictions and write arbitrary files to web-accessible folders (e.g., the web root).

2. Exploitation Mechanics & Attack Scenario

An attacker first authenticates to the application with low-privileged user credentials. They then craft a malicious HTTP POST request targeting upload.aspx. By manipulating the filename parameter or utilizing directory traversal sequences (e.g., ../), the attacker forces the application to save an executable payload, such as an ASPX webshell, into a directory accessible via web browsing. Once uploaded, the attacker accesses the webshell directly via its URL, executing arbitrary system commands under the security context of the IIS worker process (w3wp.exe). This vulnerability has been actively exploited in the wild by threat actors (such as the XE Group) for credit card skimming and initial access.

3. Infrastructure & Business Impact

Given its inclusion in the CISA KEV catalog, this vulnerability poses an immediate and severe threat to organizations running unpatched instances. Successful exploitation grants attackers full control over the web server, enabling them to exfiltrate sensitive customer data, order details, and payment information. It also serves as a launchpad for lateral movement within the internal network, deployment of ransomware, or complete business disruption.