CVE-2020-36388
📋 TL;DR
This vulnerability allows authenticated users to upload and execute malicious PHAR archives in CiviCRM, potentially leading to remote code execution. It affects CiviCRM installations before version 5.21.3 and versions 5.22.x through 5.24.x before 5.24.3. Attackers could gain control of the web server process.
💻 Affected Systems
- CiviCRM
📦 What is this software?
Civicrm by Civicrm
Civicrm by Civicrm
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing arbitrary code execution, data theft, and lateral movement within the network.
Likely Case
Unauthorized file upload leading to web shell deployment and limited server access.
If Mitigated
No impact if proper file upload restrictions and user access controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated user access and ability to upload files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.21.3, 5.24.3
Vendor Advisory: https://civicrm.org/advisory/civi-sa-2020-03
Restart Required: No
Instructions:
1. Backup your CiviCRM installation and database. 2. Update to CiviCRM 5.21.3 or 5.24.3 or later. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict PHAR file uploads
allConfigure web server or application to block .phar file uploads
# In Apache .htaccess:
<FilesMatch "\.phar$">
Order Allow,Deny
Deny from all
</FilesMatch>
# In nginx config:
location ~ \.phar$ {
deny all;
}
Disable PHAR deserialization
linuxAdd PHP configuration to disable phar:// stream wrapper
php_admin_value phar.readonly On
php_admin_value phar.require_hash On
🧯 If You Can't Patch
- Implement strict file upload validation to reject PHAR files
- Restrict user permissions to minimize attack surface
🔍 How to Verify
Check if Vulnerable:
Check CiviCRM version in admin interface or via civicrm/CRM/Upgrade/Form.phpCheck Version:
grep -r "define.*CIVICRM_VERSION" /path/to/civicrm/ | head -1Verify Fix Applied:
Confirm version is 5.21.3 or 5.24.3+ and test file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with .phar extension
- POST requests to file upload endpoints with suspicious content
Network Indicators:
- HTTP requests containing PHAR magic bytes (__HALT_COMPILER())
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*file*" OR method="POST") AND (user_agent="*phar*" OR referer="*phar*" OR request_body="*__HALT_COMPILER*" OR request_body="*phar://*")