CVE-2024-57968
Advantive VeraCore Unrestricted File Upload Vulnerability
Description
CVE-2024-57968 is a critical unrestricted file upload vulnerability in Advantive VeraCore, a warehouse management and fulfillment platform. The flaw in the upload.aspx endpoint allows an authenticated attacker with low privileges to upload arbitrary files to unintended directories, including web-accessible folders where they can be executed by other users. With a CVSS v3.1 score of 9.9 and CRITICAL severity, successful exploitation can lead to remote code execution and complete system compromise. CISA has added CVE-2024-57968 to the KEV catalog with a remediation deadline of 2025-03-31, and its EPSS score of 25.14% at the 96.1th percentile indicates very high exploitation activity, linked to the XE Group threat actor.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| advantive | veracore | < 2024.4.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1(Permissions Required, Product, Release Notes)
- https://intezer.com/blog/research/xe-group-exploiting-zero-days/(Exploit, Technical Description, Third Party Advisory)
- https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57968(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2024-57968 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which occurs when an application allows users to upload files without properly validating the file type, size, or destination. In Advantive VeraCore, the upload.aspx endpoint permits authenticated users to upload files to arbitrary directories, including web-accessible locations where uploaded web shells or scripts can be executed.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
The impact of CVE-2024-57968 is critical with a changed scope, meaning exploitation can affect resources beyond the vulnerable VeraCore component. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N). Confidentiality (High): Uploaded web shells provide access to all data on the server, including warehouse management records, customer data, shipping information, and financial records. Integrity (High): An attacker can modify order data, shipping records, and inventory information, or plant additional backdoors for persistent access. Availability (High): The attacker can disrupt fulfillment operations by corrupting data, deleting files, or taking the system offline. With a CVSS score of 9.9 (CRITICAL) and an EPSS score of 25.14% at the 96.1th percentile, this vulnerability has been actively exploited by the XE Group threat actor in campaigns targeting supply chain and fulfillment infrastructure.
Exploit Maturity
CVE-2024-57968 demonstrates high exploit maturity with confirmed active exploitation by an identified threat actor. CISA has added this vulnerability to the KEV catalog, and public exploit details and technical analysis are available via Intezer and Solis Security, which document the XE Group's exploitation of this vulnerability as a zero-day. The EPSS score of 25.14% at the 96.1th percentile places it in the top 4% of all vulnerabilities by exploitation probability. The ransomware association is classified as unknown, but the XE Group has used this vulnerability in combination with CVE-2025-25181 (SQL injection) for complete system compromise, deploying web shells for persistent access and data exfiltration from warehouse management systems.
Remediation
-
Upgrade Advantive VeraCore to version 2024.4.2.1 or later immediately. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The fix is documented in the VeraCore Release Notes.
-
Scan for web shells on the VeraCore server by examining web-accessible directories for suspicious files, particularly .aspx, .asp, .php, or .jsp files in upload directories. The XE Group is known to deploy web shells through this vulnerability for persistent access.
-
Restrict the upload functionality by implementing server-side file type validation, enforcing strict upload directory permissions, and ensuring uploaded files cannot be executed by the web server. Configure the web server to serve uploaded files as static content only.
-
Conduct a comprehensive forensic investigation given the XE Group's documented exploitation of this vulnerability. Review server logs for unusual upload activity, check for unauthorized files in web directories, and examine network traffic for command-and-control communications or data exfiltration.
-
Implement web application firewall (WAF) rules to detect and block file upload attacks, including rules for detecting web shell payloads, unusual file extensions in upload requests, and directory traversal attempts in upload path parameters.
Technical Details
CVE-2024-57968 is an unrestricted file upload vulnerability (CWE-434) in Advantive VeraCore with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerability exists in the upload.aspx endpoint, which allows authenticated users to upload files as part of normal warehouse management operations. However, the endpoint fails to restrict the upload destination directory, file type, or file content, allowing an attacker with low-level privileges (PR:L) to upload arbitrary files to any web-accessible directory on the server. The changed scope (S:C) indicates that the uploaded files can affect resources beyond the VeraCore application itself, as web shells or other malicious files uploaded to public directories can be accessed and executed by other users or services. The XE Group has been documented exploiting this vulnerability to upload ASP/ASPX web shells that provide persistent remote command execution on the server. The network vector (AV:N), low complexity (AC:L), and no user interaction (UI:N) combined with the maximum CIA impact (C:H/I:H/A:H) and score of 9.9 reflect the critical severity of allowing arbitrary file upload to a web-accessible application server.
Frequently Asked Questions
Is CVE-2024-57968 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2024-57968 to the KEV catalog. The XE Group threat actor has been documented exploiting this vulnerability as a zero-day. The EPSS score of 25.14% at the 96.1th percentile confirms high exploitation activity.
What products are affected by CVE-2024-57968?
Adventive VeraCore versions prior to 2024.4.2.1 are affected. Organizations using VeraCore for warehouse management and fulfillment operations should verify their version and upgrade immediately.
How do I fix CVE-2024-57968?
Upgrade to Advantive VeraCore 2024.4.2.1 or later. Scan for web shells in web-accessible directories, conduct forensic analysis for XE Group indicators, and implement strict file upload validation and directory permissions.
How severe is CVE-2024-57968?
CVE-2024-57968 has a CVSS score of 9.9 (CRITICAL) with a changed scope, meaning it can impact systems beyond VeraCore itself. The unrestricted file upload enables remote code execution through web shell deployment, and it has been linked to targeted campaigns by the XE Group.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.