CVE-2024-12138
📋 TL;DR
A critical deserialization vulnerability in horilla up to version 1.2.1 allows remote attackers to execute arbitrary code by manipulating specific functions. This affects all systems running vulnerable versions of the horilla software, potentially leading to complete system compromise.
💻 Affected Systems
- horilla
📦 What is this software?
Horilla by Horilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attacker to gain shell access, install malware, or pivot to other systems.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented.
🎯 Exploit Status
Public exploit code available on GitHub, making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider migrating to alternative software or implementing strict workarounds.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to horilla instances using firewall rules
iptables -A INPUT -p tcp --dport [horilla_port] -s [trusted_networks] -j ACCEPT
iptables -A INPUT -p tcp --dport [horilla_port] -j DROP
Application Firewall Rules
allBlock access to vulnerable endpoints using web application firewall
# WAF rule to block /request_new, /get_employee_shift, /create_reimbursement, /key_result_current_value_update, /create_meetings, /create_skills
🧯 If You Can't Patch
- Isolate horilla instances in separate network segments with strict firewall rules
- Implement web application firewall to block malicious requests to vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check horilla version. If version is 1.2.1 or earlier, system is vulnerable.Check Version:
Check horilla configuration files or admin interface for version informationVerify Fix Applied:
No official fix available. Verify workarounds by testing restricted access to vulnerable endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /request_new, /get_employee_shift, /create_reimbursement, /key_result_current_value_update, /create_meetings, /create_skills endpoints
- Suspicious deserialization errors in application logs
Network Indicators:
- Unusual outbound connections from horilla server
- Traffic patterns indicating exploitation attempts
SIEM Query:
source="horilla_logs" AND (uri_path="/request_new" OR uri_path="/get_employee_shift" OR uri_path="/create_reimbursement" OR uri_path="/key_result_current_value_update" OR uri_path="/create_meetings" OR uri_path="/create_skills")