CVE-2021-44892
📋 TL;DR
This is a Remote Code Execution vulnerability in ThinkPHP 3.x.x that allows attackers to execute arbitrary code on affected servers by manipulating the value[_filename] parameter in index.php. It affects all ThinkPHP 3.x.x installations, potentially giving attackers full control over vulnerable web servers.
💻 Affected Systems
- ThinkPHP
📦 What is this software?
Thinkphp by Thinkphp
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing data theft, malware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Webshell deployment leading to data exfiltration, credential harvesting, and use as attack platform.
If Mitigated
Attack blocked at WAF/IPS layer with no successful exploitation.
🎯 Exploit Status
Simple HTTP request exploitation with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Upgrade to ThinkPHP 5.x or 6.x
Vendor Advisory: https://github.com/top-think/thinkphp
Restart Required: No
Instructions:
1. Backup current application. 2. Migrate application to ThinkPHP 5.x or 6.x. 3. Test migrated application functionality. 4. Deploy updated application.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter value[_filename] parameter
Add validation in controller: if(isset($_POST['value']['_filename'])) { $filename = filter_var($_POST['value']['_filename'], FILTER_SANITIZE_STRING); }
WAF Rule Block
allBlock requests containing suspicious value[_filename] patterns
WAF rule: deny if request contains 'value[_filename]' with special characters
🧯 If You Can't Patch
- Implement strict WAF rules blocking all requests with value[_filename] parameter
- Isolate affected servers behind additional firewall layers with strict egress filtering
🔍 How to Verify
Check if Vulnerable:
Check ThinkPHP version in application files or via version.phpCheck Version:
grep -r "THINK_VERSION" application/ or check vendor/thinkphp/VERSIONVerify Fix Applied:
Verify ThinkPHP version is 5.x or higher and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing value[_filename] parameter with suspicious values
- Unusual file creation in web directories
- PHP execution from unexpected locations
Network Indicators:
- HTTP POST requests to index.php with value[_filename] parameter
- Outbound connections from web server to unknown IPs
SIEM Query:
source="web_logs" AND (value[_filename] CONTAINS "php://" OR value[_filename] CONTAINS "system(")