CVE-2024-10290

Executive Summary

CVE-2024-10290 is a problematic information disclosure vulnerability identified in ZZCMS 2023. The flaw resides in the file 3/qq-connect2.0/API/com/inc.php and allows an unauthenticated remote attacker to access sensitive information. The vulnerability has been publicly disclosed with a proof-of-concept, increasing the risk of exploitation. No official patch or vendor advisory has been released at this time.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (ZZCMS) and does not involve a software supply chain component.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. Based on the description and public exploit, the following is an estimated breakdown:

• Attack Vector (AV): Network (N) – The attack is remotely exploitable.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive information is disclosed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Base Score: 7.5 (High)

Threat Level: High – due to remote, unauthenticated access and public exploit availability.

Deep Dive & Mechanics

The vulnerability exists in the file 3/qq-connect2.0/API/com/inc.php within ZZCMS 2023. This file is part of the QQ Connect 2.0 integration, which handles OAuth-like authentication with QQ (Tencent). The exact mechanism of the information disclosure is not fully detailed, but based on the public exploit, it likely involves:

• Direct access to configuration or debug files: The inc.php file may expose database credentials, API keys, or internal paths when accessed directly.
• Lack of access controls: The file does not verify user authentication or authorization before serving sensitive data.
• Verbose error messages: The file may output stack traces or configuration details in response to malformed requests.

The attack is trivial: an attacker sends a crafted HTTP request to the vulnerable endpoint and receives sensitive information in the response.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. The vulnerable code is in 3/qq-connect2.0/API/com/inc.php. A hypothetical patch would:

• Restrict direct access to the file (e.g., via .htaccess or PHP header checks).
• Remove or obfuscate sensitive configuration data.
• Implement authentication checks before serving any data.

Vulnerable Code Snippet (Hypothetical):

<?php
// Vulnerable: No access control
$config = parse_ini_file("config.ini");
echo json_encode($config);
?>

Patched Code Snippet (Hypothetical):

<?php
// Patched: Check for valid session
session_start();
if (!isset($_SESSION['user_id'])) {
    header('HTTP/1.0 403 Forbidden');
    exit('Access denied');
}
$config = parse_ini_file("config.ini");
echo json_encode($config);
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running ZZCMS 2023 with the QQ Connect 2.0 module enabled.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/3/qq-connect2.0/API/com/inc.php
2. Send a GET request to the endpoint.
3. Observe the response for sensitive data (e.g., database credentials, API keys).

Example using cURL:

curl -v http://target/3/qq-connect2.0/API/com/inc.php

Expected Output (Hypothetical):

{
  "db_host": "localhost",
  "db_user": "root",
  "db_pass": "secret123",
  "qq_appid": "123456",
  "qq_appkey": "abcdef"
}

Blue Team

Detection:

• Monitor for requests to /3/qq-connect2.0/API/com/inc.php from external IPs.
• Alert on any successful response containing configuration data.

Hunting:

• Search web server logs for com/inc.php in the request URI.
• Look for anomalous outbound data transfers from the web server.

Lab Setup:

• Deploy a vulnerable ZZCMS 2023 instance in an isolated environment.
• Use a tool like Burp Suite or cURL to simulate the attack.
• Verify detection rules trigger correctly.

Indicators of Compromise (IOCs)

• File Path: /3/qq-connect2.0/API/com/inc.php
• HTTP Request Pattern: GET /3/qq-connect2.0/API/com/inc.php HTTP/1.1
• Response Pattern: JSON or plaintext containing configuration data (e.g., db_host, db_user, db_pass, qq_appid, qq_appkey).
• Network Indicators: Outbound connections from the web server to unknown IPs (if credentials are exfiltrated).

Detection Engineering

YARA Rule

rule CVE_2024_10290_InfoDisclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-10290 in ZZCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10290"
    strings:
        $s1 = "com/inc.php" ascii wide nocase
        $s2 = "db_host" ascii wide nocase
        $s3 = "db_pass" ascii wide nocase
        $s4 = "qq_appkey" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-10290 - ZZCMS Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable ZZCMS endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|contains: '/3/qq-connect2.0/API/com/inc.php'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10290 - ZZCMS Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/3/qq-connect2.0/API/com/inc.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the vulnerable file using web server rules (e.g., .htaccess for Apache):

   <Files "com/inc.php">
       Require all denied
   </Files>
   

2. Remove or disable the QQ Connect 2.0 module if not in use.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply an official patch from ZZCMS when available.
• Upgrade to a patched version of ZZCMS.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable path.

Workaround:

• Move the com/inc.php file outside the web root and update any references.

Valters IT