CVE-2024-32418
📋 TL;DR
This vulnerability in flusity CMS v2.33 allows remote attackers to execute arbitrary code through the add_addon.php component, leading to complete system compromise. It affects all systems running the vulnerable version of flusity CMS. Attackers can gain full control over affected web servers.
💻 Affected Systems
- flusity CMS
📦 What is this software?
Flusity by Flusity
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining root/admin privileges, data exfiltration, ransomware deployment, and persistent backdoor installation.
Likely Case
Web server compromise leading to website defacement, data theft, and use as a pivot point for internal network attacks.
If Mitigated
Limited impact with proper network segmentation, WAF rules blocking the exploit path, and restricted file upload permissions.
🎯 Exploit Status
References indicate proof-of-concept exists. The high CVSS score and remote code execution nature make weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check flusity CMS vendor website for security updates
2. Upgrade to a patched version if available
3. If no patch exists, implement workarounds immediately
🔧 Temporary Workarounds
Disable add_addon.php
linuxRemove or restrict access to the vulnerable component
mv /path/to/flusity/add_addon.php /path/to/flusity/add_addon.php.disabled
chmod 000 /path/to/flusity/add_addon.php.disabled
Implement WAF Rules
allBlock requests to add_addon.php at web application firewall level
🧯 If You Can't Patch
- Network segmentation to isolate flusity CMS from critical systems
- Implement strict file upload restrictions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if flusity CMS version is 2.33 and if add_addon.php file exists and is accessibleCheck Version:
Check flusity CMS configuration files or admin panel for version informationVerify Fix Applied:
Verify add_addon.php is no longer accessible or has been removed/disabled📡 Detection & Monitoring
Log Indicators:
- HTTP requests to add_addon.php with suspicious parameters
- Unusual file uploads or PHP file creation in CMS directories
- System commands executed from web process
Network Indicators:
- Outbound connections from web server to unknown IPs
- Unusual traffic patterns from CMS server
SIEM Query:
source="web_logs" AND (uri="/add_addon.php" OR uri LIKE "%add_addon%")