CVE-2023-53921
📋 TL;DR
SitemagicCMS 4.4.3 contains an unrestricted file upload vulnerability that allows attackers to upload malicious PHP files, leading to remote code execution. This affects all systems running the vulnerable version, potentially compromising the entire web application and underlying server.
💻 Affected Systems
- SitemagicCMS
📦 What is this software?
Sitemagic Cms by Sitemagic
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining shell access, installing backdoors, stealing data, and pivoting to internal networks.
Likely Case
Web application compromise leading to data theft, defacement, or cryptocurrency mining malware installation.
If Mitigated
Attack blocked at web application firewall level with no successful exploitation.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.4 or later
Vendor Advisory: https://sitemagic.org/Download.html
Restart Required: No
Instructions:
1. Download latest version from sitemagic.org 2. Backup current installation 3. Replace files with patched version 4. Verify upload functionality is properly restricted
🔧 Temporary Workarounds
Restrict file upload extensions
allConfigure web server to block .phar and .php file uploads to files/images directory
# Apache: Add to .htaccess in files/images directory
<FilesMatch "\.(phar|php)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~* /files/images/.*\.(phar|php)$ {
deny all;
}
Disable PHP execution in upload directory
allPrevent PHP files from executing in the vulnerable directory
# Apache: Add to .htaccess in files/images directory
php_flag engine off
# Nginx: Add to server block
location ~* /files/images/.*\.php$ {
return 403;
}
🧯 If You Can't Patch
- Implement web application firewall with file upload restrictions
- Monitor and alert on .phar/.php file uploads to files/images directory
🔍 How to Verify
Check if Vulnerable:
Check if running SitemagicCMS version 4.4.3 and test if .phar files can be uploaded to files/images directoryCheck Version:
Check SMVersion.txt file in SitemagicCMS root directoryVerify Fix Applied:
Verify version is 4.4.4+ and test that .phar/.php file uploads to files/images are blocked📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to upload endpoints with .phar/.php extensions
- File creation events in files/images directory with .phar/.php extensions
- Unusual process execution from web server user
Network Indicators:
- POST requests with file uploads to /files/images/
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_server" AND (uri_path="/files/images/" AND method="POST") AND (file_extension="phar" OR file_extension="php")