CVE-2024-46084
📋 TL;DR
Scriptcase versions 9.10.023 and earlier contain a vulnerability in the nm_unzip function that allows remote attackers to execute arbitrary code on affected systems. This affects all organizations using vulnerable Scriptcase installations, particularly web applications built with this low-code development platform.
💻 Affected Systems
- Scriptcase
📦 What is this software?
Scriptcase by Scriptcase
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal sensitive data, pivot to internal networks, and establish persistent access.
Likely Case
Web server compromise leading to data theft, defacement, or use as part of botnets for further attacks.
If Mitigated
Limited impact through network segmentation and strict access controls, potentially containing damage to isolated environments.
🎯 Exploit Status
The vulnerability is publicly documented with technical details available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.10.024 or later
Vendor Advisory: http://scriptcase.com
Restart Required: Yes
Instructions:
1. Backup your Scriptcase installation and databases. 2. Download the latest version from scriptcase.com. 3. Follow the official upgrade procedure. 4. Restart web services. 5. Verify functionality of your applications.
🔧 Temporary Workarounds
Disable vulnerable function
allTemporarily disable or restrict access to the nm_unzip function if not required
Modify Scriptcase configuration to remove or restrict nm_unzip functionality
Web Application Firewall rules
allBlock requests containing suspicious nm_unzip parameters
Configure WAF to block requests with patterns matching nm_unzip exploitation
🧯 If You Can't Patch
- Isolate affected systems from internet access and restrict to internal networks only
- Implement strict network segmentation and monitor all traffic to/from Scriptcase servers
🔍 How to Verify
Check if Vulnerable:
Check Scriptcase version in administration panel or configuration filesCheck Version:
Check Scriptcase admin panel or examine configuration files for version informationVerify Fix Applied:
Verify version is 9.10.024 or later and test nm_unzip functionality📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Scriptcase endpoints
- Suspicious file operations or command execution attempts
- Multiple failed exploitation attempts
Network Indicators:
- Unexpected outbound connections from Scriptcase servers
- Traffic patterns matching known exploit payloads
SIEM Query:
source="web_server_logs" AND (uri="*nm_unzip*" OR post_data CONTAINS "nm_unzip")