VeraCore: Unrestricted Upload of File with Dangerous Type (CVE-2024-57968) #shorts

Summary

In today's podcast, we delve into a critical vulnerability, CVE-2024-57968, identified in Advantive's VeraCore software. This vulnerability has been actively exploited by cybercrime gang XE Group, posing significant risks to sectors such as manufacturing and distribution. We'll explore the implications, technical details, and mitigation strategies in our discussion.

Product details

The affected product is Advantive's VeraCore, an integrated order fulfillment and distribution system used widely across various industries, particularly in manufacturing and distribution sectors. The affected versions are those before 2024.4.2.1, which have been identified as vulnerable to this critical security flaw.

Vulnerability type summary

CVE-2024-57968 is classified under CWE-434, which involves the unrestricted upload of a file with a dangerous type. This flaw enables remote authenticated users to upload files to unintended folders, potentially compromising systems by allowing access to sensitive data through web browsing.

Details of the vulnerability

CVE-2024-57968 specifically targets the upload.aspx file in Advantive's VeraCore software. This vulnerability allows for privilege escalation by enabling users to upload files to unintended folders that might be inadequately protected and exposed to other users. XE Group, a cybercrime entity, has exploited this zero-day vulnerability alongside CVE-2025-25181, emphasizing the need for immediate action to protect affected systems.

Conclusion

To mitigate the risks posed by CVE-2024-57968, it is crucial for users of Advantive's VeraCore to update their systems to version 2024.4.2.1 or later. Organizations should also maintain robust security measures and vigilance against potential exploitation by threat actors like the XE Group, who have shown persistent interest in leveraging such vulnerabilities. Stay informed, stay updated, and protect your digital infrastructure.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1
• https://intezer.com/blog/research/xe-group-exploiting-zero-days/
• https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/