SPIP BigUp Unauthenticated RCE Exploit (CVE-2024-8517)

Description

This Python script exploits an unauthenticated Remote Code Execution (RCE) vulnerability in the BigUp plugin of the SPIP CMS (Système de Publication pour l'Internet Partagé). The flaw lies in the lister_fichiers_par_champs function, which fails to properly validate input when the bigup_retrouver_fichiers parameter is set to 1. This allows an attacker to upload a malicious PHP payload and achieve arbitrary code execution on the server without authentication.

Affected SPIP versions:

• ≤ 4.3.1
• ≤ 4.2.15
• ≤ 4.1.17

About This Script

This version of the exploit was written to work in restricted lab environments (like Guacamole-based virtual labs used in some pentesting platforms), where:

• Internet access is blocked
• You cannot install external Python packages via pip

Unlike the original public version, this script does not require libraries such as rich_click,alive_progress, prompt_toolkit ,beautifulsoup4, or random_user_agent. It uses only standard Python libraries, making it more portable and usable in air-gapped or locked-down environments.

Key Features

• No external Python dependencies
• Works in offline lab environments (e.g., eJPTv2/ecpptv3 Guacamole labs)
• Uploads a basic web shell or command-execution payload
• Exploits the vulnerability without authentication

Usage

python3 exploit.py http://10.5.29.66 #target IP

## Credits

This script was adapted from a publicly available exploit originally posted at:

- https://github.com/Chocapikk/CVE-2024-8517