kre80r/cve-2024-44902-envVulnerable ThinkPHP 8.0.4 test environment for CVE-2024-44902 nuclei template validation
Vulnerable environment for nuclei-templates validation.
| Field | Value |
|---|
| CVE ID | CVE-2024-44902 |
| Severity | Critical (CVSS 9.8) |
| Product | ThinkPHP |
| Affected Versions | 6.1.3 - 8.0.4 |
| Type | Insecure Deserialization → RCE |
| CWE | CWE-502 |
ThinkPHP versions 6.1.3 through 8.0.4 contain an insecure deserialization vulnerability. When the Memcached PHP extension is installed, attackers can execute arbitrary code by sending malicious serialized data to an endpoint that calls unserialize() on user input.
The exploit leverages a gadget chain through ThinkPHP's internal classes:
ResourceRegister → DbManager → Memcached → Pivot → Model
git clone https://github.com/KrE80r/CVE-2024-44902-env.git
cd CVE-2024-44902-env
docker compose up -d
# Verify app is running
curl http://localhost:8080/
# Test with nuclei template
nuclei -t CVE-2024-44902.yaml -u http://localhost:8080 -debug
# Cleanup
docker compose down
This environment is a ThinkPHP application created with composer create-project:
topthink/think:v8.0.0topthink/framework:8.0.4 (vulnerable)/api/import?data=<serialized_payload>The vulnerable controller simulates scenarios where applications:
This is a proper ThinkPHP application structure with standard routing and controller patterns.
$ nuclei -t CVE-2024-44902.yaml -u http://localhost:8080
[CVE-2024-44902] [http] [critical] http://localhost:8080/api/import?data=...
$ nuclei -t CVE-2024-44902.yaml -u http://localhost:8090 # httpd:latest
# No results
This is a DELIBERATELY VULNERABLE environment for security testing ONLY.