CVE-2021-36547
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running Mara v7.5 by uploading a crafted PHP file to the /codebase/dir.php endpoint. Any organization using Mara v7.5 with the vulnerable component exposed is affected, potentially leading to complete system compromise.
💻 Affected Systems
- Mara
📦 What is this software?
Mara Cms by Mara Cms Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/admin privileges, data exfiltration, ransomware deployment, and persistent backdoor installation.
Likely Case
Web server compromise leading to website defacement, data theft, and use as pivot point for internal network attacks.
If Mitigated
Attack blocked at perimeter with no internal access achieved, though attempted exploitation may still cause service disruption.
🎯 Exploit Status
Exploitation requires only a single HTTP POST request with a crafted PHP file. Public proof-of-concept code is available in the referenced GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch is available. Consider upgrading to a newer version if available, or implement workarounds and monitoring.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to /codebase/dir.php endpoint using web server configuration or WAF rules
# Apache: RewriteRule ^/codebase/dir\.php - [F,L]
# Nginx: location ~ /codebase/dir\.php { deny all; }
Disable PHP file uploads
linuxConfigure web server to reject PHP file uploads to the vulnerable directory
# .htaccess for Apache: <FilesMatch "\.php$"> Order Allow,Deny Deny from all </FilesMatch>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Mara instances from critical systems
- Deploy web application firewall (WAF) with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if Mara v7.5 is installed and if /codebase/dir.php endpoint is accessible via HTTP requestsCheck Version:
Check Mara configuration files or admin interface for version informationVerify Fix Applied:
Test if the vulnerable endpoint is no longer accessible or if PHP file uploads are properly blocked📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /codebase/dir.php with PHP file uploads
- Unusual file creation in web directories
- Suspicious PHP execution in web logs
Network Indicators:
- HTTP traffic to /codebase/dir.php with file upload parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/codebase/dir.php" OR uri CONTAINS "dir.php") AND method="POST" AND (file_extension="php" OR content_type CONTAINS "php")