CVE-2020-35339
📋 TL;DR
CVE-2020-35339 is a critical remote code execution vulnerability in 74cms version 5.0.1 that allows attackers to execute arbitrary code on affected servers. Attackers can gain full server control by exploiting insecure functions in the configuration controller and ThinkPHP framework. This affects all organizations running vulnerable 74cms installations.
💻 Affected Systems
- 74cms (Qiye Recruitment System)
📦 What is this software?
74cms by 74cms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, lateral movement within network, and persistent backdoor installation.
Likely Case
Attackers gain shell access to web server, deploy web shells, steal sensitive data, and potentially pivot to other systems.
If Mitigated
Limited impact with proper network segmentation, web application firewalls, and minimal privileges, but still significant risk.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires no authentication and is trivial to execute with basic web request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 5.0.2 or later
Vendor Advisory: http://www.74cms.com/download/index.html
Restart Required: No
Instructions:
1. Download latest version from 74cms website. 2. Backup current installation. 3. Replace vulnerable files with patched versions. 4. Verify no custom modifications are overwritten. 5. Test functionality.
🔧 Temporary Workarounds
File Access Restriction
allRestrict access to vulnerable controller files via web server configuration
# For Apache: add to .htaccess
<Files "ConfigController.class.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: add to server block
location ~* /Application/Admin/Controller/ConfigController\.class\.php {
deny all;
}
WAF Rule Implementation
allDeploy web application firewall rules to block exploitation attempts
# ModSecurity rule example
SecRule ARGS "@rx eval\s*\(|system\s*\(|exec\s*\(" \
"id:1001,phase:2,deny,msg:'RCE attempt detected'"
🧯 If You Can't Patch
- Isolate affected system in separate network segment with strict firewall rules
- Implement application-level input validation and sanitization for all user inputs
🔍 How to Verify
Check if Vulnerable:
Check if /Application/Admin/Controller/ConfigController.class.php exists and contains vulnerable eval() or system() calls. Also check ThinkPHP/Common/functions.php for insecure functions.Check Version:
Check version in /Application/Common/Conf/config.php or look for version file in installation directoryVerify Fix Applied:
Verify ConfigController.class.php no longer contains dangerous eval() calls and functions.php has proper input validation. Test with known exploit payloads.📡 Detection & Monitoring
Log Indicators:
- POST requests to /Application/Admin/Controller/ConfigController.class.php with eval/system parameters
- Unusual PHP process execution from web user
- Web shell file creation in upload directories
Network Indicators:
- HTTP requests containing base64 encoded PHP code
- Rapid succession of exploit attempts to vulnerable endpoints
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_logs" AND (uri="*ConfigController*" AND (method="POST" OR params="*eval*" OR params="*system*"))