CVE-2024-28386
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running fastmagsync v1.7.51 and earlier. Attackers can exploit the getPhpBin() component to achieve remote code execution (RCE), potentially compromising the entire server. All users of fastmagsync v1.7.51 and below are affected.
💻 Affected Systems
- fastmagsync
📦 What is this software?
Fastmag Sync by Home Made
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full control, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Web server compromise leading to data theft, defacement, cryptocurrency mining, or use as part of a botnet.
If Mitigated
Attack blocked at network perimeter or application firewall level, with minimal impact if proper segmentation exists.
🎯 Exploit Status
Public proof-of-concept exists showing unauthenticated RCE via parameter manipulation in cron_mutualise_job_queue.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.home-made.io/module-fastmag-sync-prestashop/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If no patch available, remove or disable the fastmagsync module immediately. 3. Consider alternative synchronization solutions.
🔧 Temporary Workarounds
Disable vulnerable endpoint
linuxBlock access to the vulnerable cron_mutualise_job_queue.php file
mv /path/to/modules/fastmagsync/crons/cron_mutualise_job_queue.php /path/to/modules/fastmagsync/crons/cron_mutualise_job_queue.php.disabled
Web server access restriction
allConfigure web server to deny access to the vulnerable script
<Location "/modules/fastmagsync/crons/cron_mutualise_job_queue.php">
Order deny,allow
Deny from all
</Location>
🧯 If You Can't Patch
- Immediately remove the fastmagsync module from production systems
- Implement strict network segmentation and web application firewall rules to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check fastmagsync version in module configuration or by examining module files. Versions 1.7.51 and below are vulnerable.Check Version:
grep -r 'version' /path/to/fastmagsync/ directory or check module configuration in PrestaShop admin panelVerify Fix Applied:
Verify the module has been completely removed or disabled, and test that cron_mutualise_job_queue.php is no longer accessible.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to cron_mutualise_job_queue.php with parameter manipulation
- PHP execution errors in web server logs
- Unexpected file creation in web directories
Network Indicators:
- HTTP requests containing 'echo', 'php', or command injection patterns targeting the vulnerable endpoint
- Unusual outbound connections from web server
SIEM Query:
web.url: "*cron_mutualise_job_queue.php*" AND (web.query: "*echo*" OR web.query: "*php*" OR web.query: "*;*" OR web.query: "*&*" OR web.query: "*|*")🔗 References
- http://fastmagsync.com
- http://home-madeio.com
- https://reference1.example.com/modules/fastmagsync/crons/cron_mutualise_job_queue.php?hosting=.%20%26%20%20echo%20%27%3C%3Fphp%20echo%20%2242ovh%22%3B%27%20%3E%20a.php%3B%23&syncway=tofastmag
- https://security.friendsofpresta.org/modules/2024/03/19/fastmagsync.html
- https://www.home-made.io/module-fastmag-sync-prestashop/
- http://fastmagsync.com
- http://home-madeio.com
- https://reference1.example.com/modules/fastmagsync/crons/cron_mutualise_job_queue.php?hosting=.%20%26%20%20echo%20%27%3C%3Fphp%20echo%20%2242ovh%22%3B%27%20%3E%20a.php%3B%23&syncway=tofastmag
- https://security.friendsofpresta.org/modules/2024/03/19/fastmagsync.html
- https://www.home-made.io/module-fastmag-sync-prestashop/
