CVE-2024-46080

Executive Summary

CVE-2024-46080 is a critical Remote Code Execution (RCE) vulnerability affecting Scriptcase v9.10.023 and prior versions. The flaw resides in the nm_zip function, which fails to properly sanitize user-supplied input, allowing an attacker to inject arbitrary PHP code. Successful exploitation enables an unauthenticated attacker to execute arbitrary commands on the underlying server, leading to full system compromise, data exfiltration, and lateral movement within the network. This vulnerability is particularly dangerous due to the lack of a confirmed patch and the widespread use of Scriptcase in enterprise environments for rapid application development.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a proprietary PHP application vulnerability. The risk is amplified by the lack of a vendor-supplied patch, meaning organizations must rely on compensating controls.

CVSS Breakdown & Threat Level

While an official CVSS vector is not provided, based on the nature of the vulnerability (unauthenticated RCE), the following is a reasonable assessment:

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the target.
• Confidentiality (C): High (H) - Full system access.
• Integrity (I): High (H) - Full system control.
• Availability (A): High (H) - Can disrupt services.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, has a public proof-of-concept, and no patch is available.

Deep Dive & Mechanics

The vulnerability is located in the nm_zip function, which is part of Scriptcase's core functionality for handling ZIP file operations. The function likely uses PHP's exec(), system(), or shell_exec() to interact with the system's ZIP utility. The flaw arises because the function does not properly sanitize the filename or path parameters passed to it.

Root Cause: The nm_zip function constructs a shell command by concatenating user-controlled input (e.g., the name of a file to be zipped or the destination path) without proper escaping or validation. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) into these parameters, allowing arbitrary command execution.

Attack Vector:

1. An attacker identifies an endpoint that calls nm_zip with user-controlled parameters (e.g., a file upload or download feature).
2. The attacker crafts a malicious request where the filename or path parameter contains a command injection payload, such as ;id.
3. The Scriptcase application passes this unsanitized input to the nm_zip function.
4. The function executes the shell command, which now includes the attacker's injected command.
5. The output of the injected command is returned to the attacker or executed on the server.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code pattern is likely similar to the following:

Vulnerable Code (Conceptual):

function nm_zip($source, $destination) {
    $command = "zip -r " . $destination . " " . $source;
    $output = shell_exec($command);
    return $output;
}

Patched Code (Conceptual):

function nm_zip($source, $destination) {
    // Use escapeshellarg() to sanitize inputs
    $safe_source = escapeshellarg($source);
    $safe_destination = escapeshellarg($destination);
    $command = "zip -r " . $safe_destination . " " . $safe_source;
    $output = shell_exec($command);
    return $output;
}

The key difference is the use of escapeshellarg() to ensure that user input is treated as a single argument and cannot break out of the command string.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Scriptcase instance (v9.10.023 or earlier).
• Knowledge of an endpoint that uses the nm_zip function (e.g., a file export or backup feature).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy (e.g., Burp Suite) to intercept requests. Look for parameters that are passed to a ZIP-related function. Common parameter names include file, path, filename, destination.
2. Craft the payload: Inject a command using shell metacharacters. For example, if the parameter is file, send:

   file=test.txt;id
   

3. Execute the exploit: Send the crafted request. The server will execute the id command and return the output.
4. Achieve RCE: Use a more sophisticated payload to establish a reverse shell or execute arbitrary commands.

Example Payload (URL-encoded):

file=test.txt%3Bid

Lab Setup:

• Use Docker to create a vulnerable environment.
• Install Scriptcase v9.10.023.
• Create a simple PHP page that calls nm_zip with user input.

Blue Team (Defensive)

Detection:

• Monitor for unusual shell command execution from the web server user (e.g., www-data).
• Look for HTTP requests containing shell metacharacters (;, |, &&, `) in parameters related to file operations.
• Analyze web server logs for requests to endpoints that handle ZIP operations.

Prevention:

• Immediate: Disable or restrict access to any functionality that uses the nm_zip function.
• Network: Implement a Web Application Firewall (WAF) with rules to block command injection attempts.
• System: Apply the principle of least privilege to the web server user. Ensure it cannot write to sensitive directories.
• Code: If possible, modify the nm_zip function to use PHP's ZipArchive class instead of shell commands.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing shell metacharacters in parameters (e.g., ;, |, `).
  • Outbound connections from the web server to unknown IP addresses (reverse shell).
  • Unusual DNS queries from the web server.
• Host:
  • Unexpected processes running as the web server user (e.g., nc, bash, python).
  • New files in the web root directory (e.g., .php webshells).
  • Modified system binaries or configuration files.
  • Unusual entries in the system log (e.g., /var/log/syslog).
• File:
  • Files with suspicious names in the web root (e.g., cmd.php, shell.php).
  • Unexpected ZIP files created in temporary directories.

Detection Engineering

YARA Rule

rule CVE_2024_46080_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Scriptcase nm_zip function"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46080"
    strings:
        $cmd1 = /nm_zip\s*\(.*[;&|`]/
        $cmd2 = /shell_exec\s*\(.*\$_(GET|POST|REQUEST|COOKIE)/
        $cmd3 = /exec\s*\(.*\$_(GET|POST|REQUEST|COOKIE)/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-46080 Scriptcase nm_zip Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts via the nm_zip function in Scriptcase
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-46080
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in query strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46080 Scriptcase nm_zip Command Injection Attempt"; flow:to_server,established; content:"nm_zip"; http_uri; pcre:"/nm_zip.*[;&|`]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, isolate the affected Scriptcase instance from the network.
2. Disable: Disable any functionality that uses the nm_zip function.
3. WAF: Deploy or update a Web Application Firewall (WAF) with rules to block command injection payloads.

Long-Term Actions:

1. Patch: Monitor the Scriptcase vendor for an official patch. Apply it immediately when available.
2. Code Review: Conduct a thorough code review of all functions that execute shell commands. Use escapeshellarg() and escapeshellcmd() to sanitize input.
3. Upgrade: Consider migrating to a different rapid application development platform if Scriptcase does not provide a timely patch.
4. Harden: Apply the principle of least privilege to the web server user. Disable dangerous PHP functions like exec(), system(), shell_exec(), and passthru() in php.ini if they are not required.

Valters IT
Securing Your Digital Frontier