CVE-2024-11122
π TL;DR
This critical vulnerability in Lingdang CRM allows attackers to upload arbitrary files without restrictions via the /crm/wechatSession/index.php endpoint. Attackers can exploit this remotely to potentially execute malicious code on affected systems. All users of Lingdang CRM up to version 8.6.4.3 are vulnerable.
π» Affected Systems
- δΈζ΅·η΅ε½δΏ‘ζ―η§ζζιε ¬εΈ Lingdang CRM
π¦ What is this software?
β οΈ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of the compromised system.
If Mitigated
File upload attempts are blocked or logged, preventing successful exploitation while maintaining system functionality.
π― Exploit Status
The exploit has been publicly disclosed and requires minimal technical skill to execute. Attackers can upload malicious files without authentication.
π οΈ Fix & Mitigation
β Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. The vendor did not respond to disclosure. Consider upgrading to any version above 8.6.4.3 if available, or implement workarounds.
π§ Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or server configuration to block access to /crm/wechatSession/index.php
# Apache: RewriteRule ^/crm/wechatSession/index\.php$ - [F]
# Nginx: location ~ /crm/wechatSession/index\.php { deny all; }
Implement file upload restrictions
allConfigure server to restrict file uploads to specific directories with proper permissions and file type validation
# Example PHP configuration: upload_max_filesize = 1M
# post_max_size = 1M
# disable_functions = exec,system,passthru,shell_exec
π§― If You Can't Patch
- Implement network segmentation to isolate the CRM system from critical infrastructure
- Deploy a web application firewall with rules to detect and block file upload exploitation attempts
π How to Verify
Check if Vulnerable:
Check if /crm/wechatSession/index.php exists and accepts file uploads via the 'file' parameter. Test with harmless file upload attempts.Check Version:
Check CRM version in admin panel or configuration files. Look for version numbers <= 8.6.4.3.Verify Fix Applied:
Attempt to upload a file to the vulnerable endpoint. Successful upload indicates the system remains vulnerable.π‘ Detection & Monitoring
Log Indicators:
- Unusual file uploads to /crm/wechatSession/index.php
- POST requests with file parameters to the vulnerable endpoint
- Execution of unexpected PHP files in upload directories
Network Indicators:
- HTTP POST requests to /crm/wechatSession/index.php with file upload content
- Unusual outbound connections from the CRM server
SIEM Query:
source="web_server" AND (uri="/crm/wechatSession/index.php" AND method="POST" AND size>100000) OR (process="php" AND parent_process="web_server" AND cmdline="*upload*"))