CVE-2022-24711: CodeIgniter4 RCE Vulnerability

CVE-2022-24711 Overview

CVE-2022-24711 is a critical improper input validation vulnerability affecting CodeIgniter4, the 4.x branch of the CodeIgniter PHP full-stack web framework. Prior to version 4.1.9, the framework fails to properly validate input, allowing attackers to execute CLI (Command Line Interface) routes via HTTP requests. This vulnerability enables remote attackers to invoke commands that should only be accessible from the command line, potentially leading to unauthorized actions, data manipulation, or complete system compromise.

Critical Impact

Remote attackers can execute CLI-only routes through HTTP requests without authentication, potentially gaining unauthorized access to administrative functions and system commands that were intended to be protected from web access.

Affected Products

• CodeIgniter4 versions prior to 4.1.9
• Applications built on CodeIgniter4 that expose CLI routes
• Web servers running vulnerable CodeIgniter4 applications

Discovery Timeline

• 2022-02-28 - CVE-2022-24711 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24711

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in CodeIgniter4's routing mechanism. The framework failed to adequately distinguish between HTTP requests and CLI requests when processing routes. This architectural flaw allowed attackers to craft malicious HTTP requests that would trigger CLI-only routes, effectively bypassing the intended access control separation between web and command-line interfaces.

The attack can be executed remotely over the network without requiring any privileges or user interaction. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system, as attackers gain the ability to execute commands that were designed to be restricted to server administrators with CLI access.

Root Cause

The root cause is an improper input validation issue where CodeIgniter4's routing system failed to properly verify the execution context of incoming requests. The framework did not adequately enforce separation between CLI routes and HTTP routes, allowing the request type to be spoofed or manipulated. This means routes defined exclusively for CLI execution could be invoked through carefully crafted HTTP requests.

Attack Vector

The attack vector is network-based, requiring the attacker to send specially crafted HTTP requests to the vulnerable CodeIgniter4 application. The attacker does not need authentication or any special privileges to exploit this vulnerability. By manipulating request parameters or headers, an attacker can trick the application into routing the request as if it were a CLI command, thereby executing restricted functionality.

         "psr/log": "^1.1"
     },
     "require-dev": {
-        "codeigniter/coding-standard": "^1.1",
+        "codeigniter/coding-standard": "1.2.*",
         "fakerphp/faker": "^1.9",
-        "friendsofphp/php-cs-fixer": "^3.1",
+        "friendsofphp/php-cs-fixer": "3.2.*",
         "mikey179/vfsstream": "^1.6",
         "nexusphp/cs-config": "^3.3",
         "nexusphp/tachycardia": "^1.0",
-        "phpstan/phpstan": "^1.0",
+        "phpstan/phpstan": "1.4.3",
         "phpunit/phpunit": "^9.1",
         "predis/predis": "^1.1",
         "rector/rector": "0.12.10"

Source: GitHub Security Patch

Detection Methods for CVE-2022-24711

Indicators of Compromise

• Unusual HTTP requests targeting CLI route paths or endpoints in web server access logs
• HTTP requests containing CLI-specific parameters or command-line arguments
• Unexpected execution of CLI-designated commands during web request processing
• Application logs showing CLI route execution without corresponding shell access

Detection Strategies

• Monitor web application firewall (WAF) logs for requests attempting to access known CLI route patterns
• Implement application-level logging to track route resolution and flag HTTP requests that resolve to CLI routes
• Deploy intrusion detection rules to identify HTTP requests containing CLI-specific payloads or headers
• Review CodeIgniter4 application logs for route resolution anomalies

Monitoring Recommendations

• Configure alerting for HTTP requests to endpoints typically reserved for CLI operations
• Enable verbose logging in CodeIgniter4 to capture route resolution details
• Monitor for unusual patterns of administrative function execution through web interfaces
• Implement real-time log analysis to detect exploitation attempts

How to Mitigate CVE-2022-24711

Immediate Actions Required

• Upgrade CodeIgniter4 to version 4.1.9 or later immediately
• Review application logs for signs of exploitation attempts
• Audit all CLI routes defined in your CodeIgniter4 applications for potential exposure
• Implement network-level restrictions to limit access to the application while patching

Patch Information

The CodeIgniter team has released version 4.1.9 which contains the security fix for this vulnerability. The patch implements proper validation to ensure CLI routes cannot be executed via HTTP requests. The fix can be reviewed in the GitHub commit 202f41ad. Organizations should update their composer dependencies to pull the latest secure version. For additional technical details, refer to the GitHub Security Advisory GHSA-xjp4-6w75-qrj7.

Workarounds

• There are currently no known workarounds for this vulnerability according to the security advisory
• The only effective mitigation is upgrading to version 4.1.9 or later
• As a temporary measure, consider restricting network access to the application until patching is complete

# Update CodeIgniter4 to patched version
composer require codeigniter4/framework:^4.1.9

# Verify the installed version
composer show codeigniter4/framework | grep version