CVE-2024-14037 is an arbitrary file upload vulnerability in Guangzhou Red Sea Cloud Computing Co., Ltd.'s Red Sea Cloud eHR product. Unauthenticated attackers can exploit the PtFjk.mob servlet endpoint by submitting a multipart POST request containing a JSP webshell disguised with a spoofed image/jpeg Content-Type header. Due to missing validation of file extensions and MIME types, the malicious file is accepted and stored under the uploadfile directory at a predictable path. The web server can then execute the uploaded JSP file directly, resulting in remote code execution. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. As of the published date, no official fix or patch has been disclosed.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. The vulnerability bypasses file type validation by spoofing the Content-Type header, enabling the upload and execution of malicious JSP webshells. This can result in unauthorized access, data theft, or further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PtFjk.mob servlet endpoint if possible, and monitor for suspicious file uploads or webshell activity. Avoid exposing the uploadfile directory to direct web access if feasible.