CVE-2024-24725
📋 TL;DR
This vulnerability allows remote authenticated users to execute arbitrary PHP code through deserialization attacks in Gibbon's import functionality. Attackers can achieve remote code execution by manipulating the columnOrder parameter in POST requests. All Gibbon installations up to version 26.0.00 are affected.
💻 Affected Systems
- Gibbon
📦 What is this software?
Gibbon by Gibbonedu
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to web shell deployment, credential harvesting, and data exfiltration from the Gibbon database.
If Mitigated
Limited impact if proper network segmentation, web application firewalls, and least privilege authentication are implemented.
🎯 Exploit Status
Exploit requires authenticated access but is straightforward to execute with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.0.01 or later
Vendor Advisory: https://gibbonedu.org/download/
Restart Required: No
Instructions:
1. Download latest version from Gibbon website. 2. Backup current installation. 3. Replace affected files with patched version. 4. Verify import functionality works correctly.
🔧 Temporary Workarounds
Disable Import Module
linuxTemporarily disable the vulnerable import functionality
mv modules/System\ Admin/import_run.php modules/System\ Admin/import_run.php.disabled
Web Application Firewall Rule
allBlock requests to the vulnerable endpoint
Add WAF rule to block POST requests containing 'modules/System%20Admin/import_run.php' with 'type=externalAssessment' and 'step=4'
🧯 If You Can't Patch
- Restrict access to import functionality to only trusted administrators
- Implement network segmentation to isolate Gibbon from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if Gibbon version is 26.0.00 or earlier and if import_run.php exists in modules/System Admin/Check Version:
grep -r 'gibbonVersion' gibbon/core/version.php | cut -d"'" -f2Verify Fix Applied:
Verify Gibbon version is 26.0.01 or later and test import functionality with safe test data📡 Detection & Monitoring
Log Indicators:
- POST requests to /modules/System%20Admin/import_run.php with columnOrder parameter containing serialized data
- Unusual PHP process execution from web user
Network Indicators:
- HTTP POST requests with unusual columnOrder parameter values to the import endpoint
SIEM Query:
source="web_logs" AND uri="*import_run.php*" AND method="POST" AND (params="*columnOrder*" OR params="*O:*")