CVE-2024-6944
📋 TL;DR
This critical vulnerability in ZhongBangKeJi CRMEB allows remote attackers to execute arbitrary code through deserialization of untrusted data in the get_image_base64 function. Affected systems include CRMEB versions up to 5.4.0, potentially enabling complete system compromise.
💻 Affected Systems
- ZhongBangKeJi CRMEB
📦 What is this software?
Crmeb by Crmeb
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or steal sensitive data from the compromised system.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and input validation are in place to block exploitation attempts.
🎯 Exploit Status
Public exploit code is available, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 5.4.0 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd strict input validation to the get_image_base64 function to reject malicious serialized data
Modify PublicController.php to validate and sanitize the 'file' parameter before processing
WAF Rule Implementation
allDeploy web application firewall rules to block deserialization attempts
Add WAF rules to detect and block patterns matching PHP object injection or serialized data in requests
🧯 If You Can't Patch
- Isolate affected systems from internet access using network segmentation
- Implement strict network monitoring and alerting for suspicious deserialization patterns
🔍 How to Verify
Check if Vulnerable:
Check CRMEB version in admin panel or by examining version files. If version is 5.4.0 or lower, system is vulnerable.Check Version:
Check admin panel or examine files like version.php, readme.txt, or composer.json for version informationVerify Fix Applied:
Test the get_image_base64 endpoint with malicious serialized data to confirm it's rejected. Review code changes in PublicController.php.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to PublicController.php with serialized data in parameters
- PHP errors related to unserialize() or object injection
Network Indicators:
- HTTP requests containing serialized PHP objects (O: or a: patterns) in parameters
- Unusual outbound connections from CRMEB server
SIEM Query:
source="web_logs" AND uri="*PublicController*" AND (param="*O:*" OR param="*a:*")🔗 References
- https://gist.github.com/J1rrY-learn/93a0cf71894570f4eb39344161beb44c
- https://vuldb.com/?ctiid.272066
- https://vuldb.com/?id.272066
- https://vuldb.com/?submit.374413
- https://gist.github.com/J1rrY-learn/93a0cf71894570f4eb39344161beb44c
- https://vuldb.com/?ctiid.272066
- https://vuldb.com/?id.272066
- https://vuldb.com/?submit.374413
