CVE-2024-25301
📋 TL;DR
CVE-2024-25301 is a remote code execution vulnerability in Redaxo CMS v5.15.1 that allows attackers to execute arbitrary code via the /pages/templates.php component. This affects all systems running the vulnerable version of Redaxo, potentially compromising the entire web server and underlying infrastructure.
💻 Affected Systems
- Redaxo CMS
📦 What is this software?
Redaxo by Redaxo
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full control over the web server, database access, and ability to pivot to other systems on the network.
Likely Case
Website defacement, data theft, malware deployment, and creation of persistent backdoors for future attacks.
If Mitigated
Limited impact with proper web application firewalls, network segmentation, and least privilege configurations in place.
🎯 Exploit Status
Exploitation requires authentication to the Redaxo admin panel. The vulnerability is in a core component and public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.15.2 or later
Vendor Advisory: https://github.com/redaxo/redaxo/releases
Restart Required: No
Instructions:
1. Backup your Redaxo installation and database. 2. Download the latest version from the official Redaxo repository. 3. Replace the vulnerable files with patched versions. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict access to admin panel
allLimit access to the Redaxo admin interface to trusted IP addresses only
# Add to .htaccess or web server config
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
Allow from 10.0.0.0/8
Disable vulnerable component
linuxTemporarily disable or restrict access to the /pages/templates.php file
# Rename or move the vulnerable file
mv /path/to/redaxo/pages/templates.php /path/to/redaxo/pages/templates.php.disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Redaxo server from critical systems
- Deploy a web application firewall (WAF) with specific rules to block RCE attempts
🔍 How to Verify
Check if Vulnerable:
Check if Redaxo version is exactly 5.15.1 by examining the version file or admin interfaceCheck Version:
grep -r "REDAXO_VERSION" /path/to/redaxo/ | head -1Verify Fix Applied:
Verify the version has been updated to 5.15.2 or later and test the /pages/templates.php functionality📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /pages/templates.php
- Multiple failed login attempts followed by successful admin login
- Suspicious file creation or modification in web directories
Network Indicators:
- Unusual outbound connections from web server
- Traffic patterns suggesting command and control communication
SIEM Query:
source="web_logs" AND (uri="/pages/templates.php" AND (method="POST" OR params CONTAINS "system" OR params CONTAINS "exec"))