CVE-2023-7334
📋 TL;DR
This CVE describes a critical .NET deserialization vulnerability in Changjetong T+ software that allows remote attackers to execute arbitrary code on affected systems. Attackers can send specially crafted requests to a vulnerable AjaxPro endpoint to trigger deserialization of malicious .NET types, leading to remote command execution. Organizations using Changjetong T+ versions up to 16.x are affected.
💻 Affected Systems
- Changjetong T+
📦 What is this software?
T\+ by Chanjetvip
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the server, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Remote code execution leading to installation of backdoors, cryptocurrency miners, or data theft from the T+ application database.
If Mitigated
Limited impact if proper network segmentation, application firewalls, and endpoint protection are in place to block exploitation attempts.
🎯 Exploit Status
Public proof-of-concept code exists and exploitation has been observed in the wild since August 2023. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 16.x
Vendor Advisory: https://www.chanjetvip.com/product/goods/detail?id=6077e91b70fa071069139f62
Restart Required: Yes
Instructions:
1. Contact Changjetong vendor for latest patched version. 2. Backup current installation and data. 3. Apply vendor-provided patch or upgrade to version after 16.x. 4. Restart T+ application services. 5. Verify the vulnerable endpoint is no longer accessible or patched.
🔧 Temporary Workarounds
Block vulnerable endpoint via WAF/IPS
allConfigure web application firewall or intrusion prevention system to block requests to the vulnerable endpoint.
WAF/IPS specific rules to block: POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore
Application firewall rule
windowsAdd URL rewrite rule in IIS to block access to the vulnerable endpoint.
<rule name="Block T+ RCE Endpoint" stopProcessing="true">
<match url="^tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx" />
<conditions>
<add input="{QUERY_STRING}" pattern="method=GetStoreWarehouseByStore" />
</conditions>
<action type="AbortRequest" />
</rule>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate T+ servers from internet and other critical systems
- Deploy endpoint detection and response (EDR) solutions with behavioral monitoring for suspicious process creation
🔍 How to Verify
Check if Vulnerable:
Check if the endpoint /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore exists and accepts POST requests with JSON payloads.Check Version:
Check T+ application version through administrative interface or consult vendor documentation for version identification methods.Verify Fix Applied:
Attempt to send a test payload to the vulnerable endpoint and verify it no longer processes deserialization requests or returns appropriate error/block messages.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx with method=GetStoreWarehouseByStore
- Unusual process creation events from T+ application service account
- JSON payloads containing .NET type names in request bodies
Network Indicators:
- HTTP traffic to T+ servers containing serialized .NET objects in POST bodies
- Outbound connections from T+ servers to suspicious external IPs following exploitation
SIEM Query:
source="web_server_logs" AND uri_path="/tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx" AND query_string="method=GetStoreWarehouseByStore" AND http_method="POST"🔗 References
- https://blog.csdn.net/qq_53003652/article/details/134031230
- https://blog.csdn.net/u010025272/article/details/131553591
- https://github.com/MD-SEC/MDPOCS/blob/main/ChangJieTongTPlus_GetStoreWarehouseByStore_Rce_Poc.py
- https://www.chanjetvip.com/product/goods/detail?id=6077e91b70fa071069139f62
- https://www.freebuf.com/articles/web/381731.html
- https://www.vulncheck.com/advisories/changjetong-tplus-getstorewarehousebystore-deserialization-rce
- https://www.freebuf.com/articles/web/381731.html
