CVE-2020-24139
📋 TL;DR
CVE-2020-24139 is a server-side request forgery (SSRF) vulnerability in Wcms 0.3.2 that allows attackers to make arbitrary HTTP requests from the vulnerable server via the path parameter in wex/cssjs.php. This enables attackers to scan internal networks, identify open ports, and potentially execute commands on local services. Anyone running Wcms 0.3.2 is affected.
💻 Affected Systems
- Wcms
📦 What is this software?
Wcms by Wcms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through command execution on internal services, data exfiltration, and lateral movement within the network.
Likely Case
Internal network reconnaissance, port scanning, and potential access to internal services that shouldn't be exposed.
If Mitigated
Limited to port scanning and service enumeration without command execution if proper network segmentation exists.
🎯 Exploit Status
Simple HTTP request manipulation required; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.3 or later
Vendor Advisory: https://github.com/vedees/wcms/issues/8
Restart Required: No
Instructions:
1. Backup your Wcms installation. 2. Download Wcms 0.3.3 or later from the official repository. 3. Replace the vulnerable wex/cssjs.php file with the patched version. 4. Verify the fix by testing the SSRF vector.
🔧 Temporary Workarounds
Block access to wex/cssjs.php
allPrevent access to the vulnerable endpoint via web server configuration
# For Apache: add to .htaccess
<Files "cssjs.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: add to server block
location ~ /wex/cssjs\.php$ {
deny all;
return 403;
}
Input validation filter
allAdd input validation to reject malicious path parameters
# Add to wex/cssjs.php before processing path parameter
if (preg_match('/^(http|https|ftp|file|gopher|ldap|dict):\/\//i', $_GET['path'])) {
http_response_code(400);
exit('Invalid path parameter');
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Wcms server from internal services
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Test by accessing http://[wcms-server]/wex/cssjs.php?path=http://localhost:22 and checking if it returns SSH banner or errorCheck Version:
Check Wcms version in admin panel or examine version.txt file in installation directoryVerify Fix Applied:
Attempt the same test after patching; should return error or be blocked📡 Detection & Monitoring
Log Indicators:
- Unusual requests to wex/cssjs.php with external URLs in path parameter
- Multiple rapid requests to wex/cssjs.php with different port numbers
Network Indicators:
- Outbound connections from Wcms server to internal services on unusual ports
- Port scanning patterns originating from Wcms server
SIEM Query:
source="wcms_access.log" AND uri="/wex/cssjs.php" AND query="*path=http*"