CVE-2019-7725
📋 TL;DR
CVE-2019-7725 is a critical deserialization vulnerability in NukeViet CMS that allows remote code execution by exploiting the untrusted nvloginhash cookie. Attackers can execute arbitrary code on affected systems by sending malicious serialized data. All NukeViet installations before version 4.3.04 are vulnerable.
💻 Affected Systems
- NukeViet CMS
📦 What is this software?
Nukeviet by Nukeviet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to deface websites, steal sensitive data, or use the server for malicious activities.
If Mitigated
Attack prevented through proper input validation and secure deserialization practices.
🎯 Exploit Status
Exploitation requires sending a specially crafted cookie, which is straightforward for attackers with basic PHP knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.04
Vendor Advisory: https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt
Restart Required: No
Instructions:
1. Backup your NukeViet installation and database. 2. Download NukeViet 4.3.04 or later from the official repository. 3. Replace all files with the patched version. 4. Clear browser cookies and cache. 5. Verify the fix by checking the version.
🔧 Temporary Workarounds
Cookie Validation Workaround
allImplement input validation for the nvloginhash cookie to reject serialized PHP objects.
Modify includes/core/is_user.php to validate cookie format before deserialization
WAF Rule Implementation
allDeploy web application firewall rules to block requests containing serialized PHP objects in cookies.
Add WAF rule to detect and block 'O:' patterns in cookie values
🧯 If You Can't Patch
- Implement strict input validation for all cookie parameters
- Deploy network segmentation and restrict access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check if NukeViet version is below 4.3.04 by examining the CHANGELOG.txt file or admin panel.Check Version:
grep 'Version' CHANGELOG.txt | head -1Verify Fix Applied:
Verify the version is 4.3.04 or higher and test that serialized PHP objects in nvloginhash cookie are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with serialized data in cookies
- PHP errors related to unserialize() function
Network Indicators:
- HTTP requests containing 'O:' or serialized PHP objects in cookie headers
SIEM Query:
source="web_logs" AND (cookie="*O:*" OR cookie="*s:*")🔗 References
- https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt
- https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt
- https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04
- https://github.com/nukeviet/nukeviet/pull/2740/commits/05dfb9b4531f12944fe39556f58449b9a56241be
- https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt
- https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt
- https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04
- https://github.com/nukeviet/nukeviet/pull/2740/commits/05dfb9b4531f12944fe39556f58449b9a56241be
