CVE-2024-46084

Executive Summary

CVE-2024-46084 identifies a critical Remote Code Execution (RCE) vulnerability in Scriptcase versions 9.10.023 and earlier. The flaw resides in the nm_unzip function, which fails to properly sanitize user-supplied archive files during extraction. An authenticated attacker can upload a malicious ZIP archive containing a PHP web shell, leading to arbitrary code execution on the underlying server. This vulnerability poses a severe risk to web applications built with Scriptcase, potentially allowing full server compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It directly affects the Scriptcase PHP framework, which is a commercial rapid application development tool. The risk is primarily to organizations that develop or host applications using Scriptcase.

CVSS Breakdown & Threat Level

While an official CVSS vector is not provided, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's own.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full system read access is possible.
• Integrity (I): High (H) – Full system write access is possible.
• Availability (A): High (H) – Full system control can lead to denial of service.

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical. The combination of low complexity, low privileges, and high impact makes this a prime target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic case of unrestricted file upload leading to remote code execution. The nm_unzip function in Scriptcase is designed to extract ZIP archives. However, it does not validate the contents of the archive before extraction.

Attack Flow:

1. Authentication: The attacker must first authenticate to the Scriptcase application (e.g., as a developer or admin).
2. Malicious Archive Creation: The attacker creates a ZIP archive containing a PHP web shell (e.g., shell.php).
3. Upload: The attacker uses a legitimate Scriptcase feature that calls nm_unzip to upload the malicious archive.
4. Extraction: The nm_unzip function extracts the archive to a web-accessible directory (e.g., /var/www/html/ or a similar path).
5. Execution: The attacker accesses the uploaded web shell via a web browser, executing arbitrary PHP commands on the server.

The core issue is the lack of file type validation, path traversal checks, and content inspection within the nm_unzip function.

Vulnerable vs. Patched Code

Since no official patch is available, we can only describe the vulnerable behavior and a hypothetical secure implementation.

Vulnerable Code (Conceptual):

function nm_unzip($zip_file, $destination) {
    $zip = new ZipArchive();
    if ($zip->open($zip_file) === TRUE) {
        $zip->extractTo($destination);
        $zip->close();
        return true;
    }
    return false;
}

This code directly extracts all files without any checks.

Patched Code (Conceptual):

function nm_unzip($zip_file, $destination) {
    $zip = new ZipArchive();
    if ($zip->open($zip_file) === TRUE) {
        for ($i = 0; $i < $zip->numFiles; $i++) {
            $filename = $zip->getNameIndex($i);
            // 1. Prevent path traversal
            $real_dest = realpath($destination);
            $real_file = realpath($real_dest . '/' . $filename);
            if (strpos($real_file, $real_dest) !== 0) {
                throw new Exception('Path traversal detected');
            }
            // 2. Validate file extension
            $ext = pathinfo($filename, PATHINFO_EXTENSION);
            if (!in_array($ext, ['txt', 'csv', 'xml'])) {
                throw new Exception('Invalid file type');
            }
            // 3. Check file content (e.g., for PHP tags)
            $content = $zip->getFromIndex($i);
            if (preg_match('/<\?php/i', $content)) {
                throw new Exception('Malicious content detected');
            }
            // 4. Extract only if all checks pass
            $zip->extractTo($destination, $filename);
        }
        $zip->close();
        return true;
    }
    return false;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Scriptcase 9.10.023 on a local server (e.g., using XAMPP or Docker).
2. Create a user account with developer privileges.
3. Identify a feature that uses the nm_unzip function (e.g., project import, theme upload).

Exploitation Steps:

1. Create a malicious ZIP archive:

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   zip malicious.zip shell.php
   

2. Log in to Scriptcase as the developer user.
3. Navigate to the vulnerable upload feature and upload malicious.zip.
4. Determine the extraction path (e.g., /projects/myapp/).
5. Access the web shell:

   http://target.com/projects/myapp/shell.php?cmd=id
   

Advanced Payload: For a more stealthy approach, use an obfuscated PHP web shell or a reverse shell payload.

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads, especially ZIP archives.
• Look for PHP files being written to web-accessible directories.
• Analyze web server logs for requests to newly created PHP files.

Prevention:

• Implement strict file upload validation on the web server level (e.g., using .htaccess or Nginx rules to block PHP execution in upload directories).
• Use a Web Application Firewall (WAF) to inspect uploaded files for malicious content.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious PHP files in unexpected directories (e.g., shell.php, cmd.php, backdoor.php).
• ZIP archives containing PHP files.
• Modified .htaccess files allowing PHP execution in upload directories.

Network-Based IOCs:

• HTTP POST requests to Scriptcase upload endpoints with Content-Type: application/zip.
• HTTP GET requests to newly created PHP files with query parameters like cmd, exec, or command.
• Outbound connections from the web server to unknown IP addresses (reverse shell).

Log-Based IOCs:

• Web server access logs showing requests to PHP files in non-standard locations.
• Error logs indicating failed file type validation attempts.

Detection Engineering

YARA Rule

rule CVE_2024_46084_Scriptcase_RCE {
    meta:
        description = "Detects malicious ZIP archives targeting Scriptcase nm_unzip RCE"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46084"
    strings:
        $php_tag = "<?php"
        $zip_magic = { 50 4B 03 04 }  // ZIP local file header
    condition:
        $zip_magic at 0 and $php_tag
}

Sigma Rule

title: Scriptcase nm_unzip RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-46084 via malicious ZIP upload
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/nm_unzip*'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate ZIP uploads by developers
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-46084 Scriptcase nm_unzip RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"nm_unzip"; http_uri; content:"application/zip"; http_content_type; pcre:"/\.php$/U"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable feature: If possible, temporarily disable any functionality that uses the nm_unzip function.
2. Restrict file uploads: Implement strict file type and content validation at the application and web server level.
3. Apply virtual patching: Use a WAF to block ZIP uploads containing PHP files.

Long-Term Fix:

1. Vendor Patch: Await an official patch from Scriptcase. Monitor their security advisories.
2. Code Hardening: If you have access to the source code, implement the patched code example provided in this report.
3. Upgrade: Upgrade to a patched version of Scriptcase as soon as it becomes available.

General Security Best Practices:

• Regularly update all software components.
• Conduct security audits and penetration testing.
• Implement the principle of least privilege for all user accounts.
• Use a Web Application Firewall (WAF) and Intrusion Detection System (IDS).

Valters IT