CVE-2023-24776
📋 TL;DR
Funadmin v3.2.0 contains a remote code execution vulnerability in the Addon.php controller component that allows attackers to execute arbitrary code on affected systems. This affects all installations running the vulnerable version of Funadmin, potentially compromising the entire server.
💻 Affected Systems
- Funadmin
📦 What is this software?
Funadmin by Funadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full control, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Webshell deployment leading to data theft, credential harvesting, and use as attack platform for further exploitation.
If Mitigated
Limited impact with proper network segmentation, WAF rules, and minimal privileges reducing attack surface.
🎯 Exploit Status
The vulnerability is in a core controller component and requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.1 or later
Vendor Advisory: https://github.com/funadmin/funadmin/issues/7
Restart Required: No
Instructions:
1. Backup current installation. 2. Download latest version from official repository. 3. Replace vulnerable files. 4. Verify functionality.
🔧 Temporary Workarounds
Disable Addon Module
linuxTemporarily disable the vulnerable Addon.php controller component
mv controller/Addon.php controller/Addon.php.disabled
WAF Rule Implementation
allAdd web application firewall rules to block malicious requests to Addon.php
🧯 If You Can't Patch
- Implement strict network access controls to limit access to Funadmin interface
- Deploy application-level monitoring and alerting for suspicious Addon.php activity
🔍 How to Verify
Check if Vulnerable:
Check if Funadmin version is exactly 3.2.0 by examining version files or admin panelCheck Version:
grep -r '3.2.0' /path/to/funadmin/ || cat /path/to/funadmin/version.txtVerify Fix Applied:
Verify version is 3.2.1 or later and test Addon.php functionality is properly secured📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Addon.php
- System command execution in web logs
- Unexpected file uploads or modifications
Network Indicators:
- HTTP requests with suspicious parameters to Addon endpoint
- Outbound connections from web server to unknown IPs
SIEM Query:
source="web_logs" AND uri="*Addon.php*" AND (method="POST" OR params="*system*" OR params="*exec*")