CVE-2024-29387

Executive Summary

CVE-2024-29387 is a critical Remote Code Execution (RCE) vulnerability discovered in Projeqtor, an open-source project management tool. The flaw resides in the /view/print.php component and affects all versions up to and including 11.2.0. An unauthenticated attacker can exploit this vulnerability to execute arbitrary PHP code on the target server, leading to full system compromise. The vulnerability is publicly known, and proof-of-concept (PoC) code is available, increasing the risk of active exploitation. No official patch has been released at this time.

Supply Chain & Package Security

Projeqtor is a PHP-based application distributed as a ZIP archive from its official website and GitHub repository. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Projeqtor should treat this as a critical supply chain risk, as the application itself is the vulnerable component. Immediate action is required to mitigate the risk until an official patch is available.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the nature of the vulnerability, the following is a reasonable assessment:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full system access possible.
• Integrity (I): High (H) – Full system control possible.
• Availability (A): High (H) – Can lead to denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and leads to complete system compromise.

Deep Dive & Mechanics

The vulnerability exists in the /view/print.php file. This script is used to generate printable views of project data. The root cause is the insecure handling of user-supplied input that is passed to PHP functions capable of executing code, such as eval(), assert(), preg_replace() with the /e modifier, or include()/require() with dynamic paths.

Specifically, the print.php script likely takes parameters (e.g., id, type, format) and uses them to construct file paths or PHP code without proper sanitization. An attacker can inject malicious PHP code into these parameters, which is then executed by the server.

Example Attack Vector: The attacker sends a crafted HTTP request to /view/print.php?type=../../../../etc/passwd%00 or similar path traversal combined with code injection. Alternatively, if the script uses eval() on a parameter, the attacker can inject arbitrary PHP code directly.

Technical Flow:

1. Attacker sends a GET/POST request to /view/print.php with malicious parameters.
2. The print.php script processes the input without validation.
3. The input is passed to a dangerous PHP function (e.g., eval("...$input...")).
4. The injected PHP code is executed on the server.
5. The attacker gains remote code execution.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the current state of print.php in Projeqtor <= 11.2.0. A patched version would need to implement proper input validation, sanitization, and avoid using dangerous PHP functions with user input.

Vulnerable Code (Conceptual):

<?php
// Vulnerable print.php
$type = $_GET['type'];
include("templates/" . $type . ".php");
?>

Patched Code (Conceptual):

<?php
// Patched print.php
$allowed_types = ['task', 'project', 'milestone'];
$type = $_GET['type'];
if (in_array($type, $allowed_types, true)) {
    include("templates/" . $type . ".php");
} else {
    die("Invalid type.");
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Projeqtor instance (<= 11.2.0).
• Network access to the web server.

Exploitation Steps:

1. Identify the target Projeqtor instance.
2. Send a crafted HTTP request to /view/print.php with a malicious payload.

Example Payload (using eval injection):

GET /view/print.php?type=task&id=1;system($_GET['cmd']);//
Host: target.com

Then execute commands:

GET /view/print.php?type=task&id=1;system($_GET['cmd']);//&cmd=id
Host: target.com

Example Payload (using file inclusion):

GET /view/print.php?type=../../../../../../../../tmp/shell
Host: target.com

(Assuming the attacker has uploaded a PHP shell to /tmp/shell.php)

Automated Exploitation with cURL:

curl -G "http://target.com/projeqtor/view/print.php" --data-urlencode "type=task;system('id');//"

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual requests to /view/print.php containing special characters like ;, |, $, {, }, or long strings.
• Look for requests with multiple parameters or unexpected parameter names.
• Use WAF rules to block requests containing PHP code patterns.

Hunting:

• Search for processes spawned by the web server user (e.g., www-data) that are not typical (e.g., id, whoami, nc, bash).
• Check for outbound connections from the web server to unknown IPs.
• Review file integrity on the web server for new or modified files in the web root.

Containment:

• Immediately isolate the affected server from the network.
• Take a forensic image of the server for analysis.
• Disable the print.php script by renaming or removing it.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /view/print.php with suspicious parameters (e.g., cmd, exec, system).
• Outbound connections from the web server to unknown IPs on common ports (80, 443, 4444, etc.).
• Unusual User-Agent strings in requests to print.php.

File System IOCs:

• New or modified PHP files in the web root (e.g., shell.php, cmd.php).
• Files in /tmp/ or /var/tmp/ with suspicious names (e.g., .php, .txt).
• Changes to /etc/passwd or /etc/shadow (if privilege escalation occurs).

Process IOCs:

• Web server processes spawning shells (e.g., /bin/sh, /bin/bash).
• Processes running as www-data executing commands like id, whoami, nc, python, perl.

Detection Engineering

YARA Rule

rule CVE_2024_29387_Projeqtor_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-29387 in Projeqtor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29387"
        severity = "critical"
    strings:
        $s1 = "print.php" nocase
        $s2 = "system(" nocase
        $s3 = "exec(" nocase
        $s4 = "shell_exec(" nocase
        $s5 = "passthru(" nocase
        $s6 = "eval(" nocase
        $s7 = "assert(" nocase
        $s8 = "preg_replace" nocase
        $s9 = "/e" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9)
}

Sigma Rule

title: Projeqtor CVE-2024-29387 RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting Projeqtor print.php with potential RCE payloads
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29387
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'print.php'
            - 'system('
            - 'exec('
            - 'shell_exec('
            - 'passthru('
            - 'eval('
            - 'assert('
            - 'preg_replace'
            - '/e'
    condition: selection
falsepositives:
    - Legitimate use of these functions in custom code (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29387 Projeqtor RCE Attempt"; flow:to_server,established; content:"print.php"; http_uri; content:"system("; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-29387 Projeqtor RCE Attempt"; flow:to_server,established; content:"print.php"; http_uri; content:"exec("; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-29387 Projeqtor RCE Attempt"; flow:to_server,established; content:"print.php"; http_uri; content:"eval("; http_uri; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2024-29387 Projeqtor RCE Attempt"; flow:to_server,established; content:"print.php"; http_uri; content:"assert("; http_uri; nocase; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable script: Rename or remove /view/print.php from the web server.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests containing dangerous PHP functions in the URI.
3. Restrict access: If the script is required, restrict access to trusted IPs only via .htaccess or firewall rules.
4. Monitor logs: Actively monitor web server logs for exploitation attempts.

Long-term Fix:

• Wait for an official patch from the Projeqtor development team.
• If you are a developer, review the print.php code and implement proper input validation, whitelisting, and avoid using dangerous PHP functions with user input.
• Consider migrating to a different project management tool if a patch is not released in a timely manner.

Workaround:

• Replace the vulnerable print.php with a safe version that only includes predefined templates and does not accept user input for file paths or code execution.

Valters IT