CVE-2021-36564
📋 TL;DR
ThinkPHP v6.0.8 contains a deserialization vulnerability in the Flysystem cached adapter component that allows remote code execution. Attackers can exploit this by sending specially crafted requests to vulnerable endpoints. This affects all systems running ThinkPHP v6.0.8 with the vulnerable component.
💻 Affected Systems
- ThinkPHP
📦 What is this software?
Thinkphp by Thinkphp
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to execute arbitrary commands, install malware, steal data, or pivot to other systems.
Likely Case
Remote code execution leading to web shell deployment, data exfiltration, or cryptocurrency mining malware installation.
If Mitigated
Limited impact if proper input validation and deserialization controls are in place, potentially resulting in denial of service only.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist and are actively used in attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.0.9 and later
Vendor Advisory: https://github.com/top-think/framework/issues/2559
Restart Required: No
Instructions:
1. Update ThinkPHP to version 6.0.9 or later using composer update topthink/framework. 2. Verify the update completed successfully. 3. Test application functionality.
🔧 Temporary Workarounds
Remove vulnerable component
allTemporarily remove or disable the league/flysystem-cached-adapter component if not essential
composer remove league/flysystem-cached-adapter
Input validation filter
allImplement strict input validation for all user-controlled data before deserialization
🧯 If You Can't Patch
- Implement WAF rules to block deserialization attempts and suspicious PHP object injection patterns
- Restrict network access to vulnerable applications using firewall rules and network segmentation
🔍 How to Verify
Check if Vulnerable:
Check composer.json for 'topthink/framework' version 6.0.8 and presence of 'league/flysystem-cached-adapter' packageCheck Version:
composer show topthink/framework | grep versionsVerify Fix Applied:
Verify composer.json shows 'topthink/framework' version 6.0.9 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with serialized data
- PHP error logs containing deserialization warnings
- Web shell file creation in web directories
Network Indicators:
- HTTP requests containing serialized PHP objects
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND ("__destruct" OR "__wakeup" OR "O:" OR "C:" OR "unserialize")