CVE-2024-42599
📋 TL;DR
SeaCMS 13.0 contains a remote code execution vulnerability in admin_files.php where authenticated attackers can bypass file editing restrictions to write and execute arbitrary code. This allows attackers to gain system privileges on vulnerable installations. Only SeaCMS 13.0 installations with admin access are affected.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining root/admin privileges, installing persistent backdoors, stealing data, and pivoting to other systems.
Likely Case
Attacker gains administrative control of the SeaCMS installation, modifies content, steals sensitive data, and potentially compromises the underlying server.
If Mitigated
Attack limited to authenticated admin users only, with proper network segmentation preventing lateral movement.
🎯 Exploit Status
Exploit requires admin credentials but is straightforward once authenticated. Public proof-of-concept exists in the referenced links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check SeaCMS official channels for updates. Consider upgrading to a newer version if available or applying workarounds.
🔧 Temporary Workarounds
Restrict admin_files.php access
allBlock or restrict access to the vulnerable admin_files.php file
# Web server configuration to block access to admin_files.php
# For Apache: add to .htaccess: <Files "admin_files.php"> Order Allow,Deny Deny from all </Files>
# For Nginx: location ~ /admin_files\.php$ { deny all; }
Remove admin_files.php
linuxDelete or rename the vulnerable file if not needed
rm /path/to/seacms/admin_files.php
# Or rename: mv admin_files.php admin_files.php.disabled
🧯 If You Can't Patch
- Implement strict access controls for admin panel with MFA and IP whitelisting
- Monitor and audit all admin account activity and file modification attempts
🔍 How to Verify
Check if Vulnerable:
Check if SeaCMS version is 13.0 and admin_files.php exists in the installation directoryCheck Version:
Check SeaCMS configuration files or admin panel for version information, typically in config files or footerVerify Fix Applied:
Verify admin_files.php is removed, renamed, or access is properly restricted via web server configuration📡 Detection & Monitoring
Log Indicators:
- Unusual file modifications in admin_files.php or related directories
- Multiple failed admin login attempts followed by successful access
- Execution of system commands via web interface logs
Network Indicators:
- Unusual outbound connections from web server to external IPs
- HTTP requests to admin_files.php with suspicious parameters
SIEM Query:
source="web_server_logs" AND (uri="*admin_files.php*" AND (param="*system*" OR param="*exec*" OR param="*shell*"))