CVE-2024-0603: Zhicms RCE Vulnerability via Deserialization

CVE-2024-0603 Overview

A critical insecure deserialization vulnerability has been discovered in ZhiCms, a content management system. The vulnerability exists in the file app/plug/controller/giftcontroller.php where the manipulation of the mylike argument leads to unsafe deserialization of user-controlled data. This flaw allows remote attackers to potentially execute arbitrary code on affected systems without authentication, posing a severe security risk to organizations running vulnerable versions of ZhiCms.

Critical Impact

Remote attackers can exploit this deserialization vulnerability to execute arbitrary code on the target system without requiring authentication, potentially leading to complete system compromise.

Affected Products

• ZhiCms versions up to 4.0
• ZhiCms installations using the gift controller functionality
• Systems with app/plug/controller/giftcontroller.php exposed

Discovery Timeline

• 2024-01-16 - CVE-2024-0603 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0603

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw occurs in the gift controller component of ZhiCms where user input passed through the mylike parameter is deserialized without proper validation or sanitization. Insecure deserialization vulnerabilities are particularly dangerous because they can allow attackers to inject malicious serialized objects that, when deserialized by the application, execute arbitrary code in the context of the application.

The vulnerability is remotely exploitable over the network without requiring user interaction or prior authentication, making it accessible to any attacker who can reach the vulnerable endpoint. Successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the improper handling of serialized data in the giftcontroller.php file. The application accepts serialized input through the mylike parameter and deserializes it without implementing proper security controls such as:

• Input validation before deserialization
• Type checking or whitelisting of allowed classes
• Signature verification of serialized data
• Sandboxing or isolation of deserialization operations

This allows attackers to craft malicious serialized payloads that exploit PHP's object instantiation and magic method execution during the deserialization process.

Attack Vector

The attack can be initiated remotely by sending specially crafted HTTP requests to the vulnerable endpoint containing malicious serialized data in the mylike parameter. Attackers can leverage PHP gadget chains present in the application or its dependencies to achieve code execution.

The exploitation process typically involves:

1. Identifying available PHP classes and their magic methods within the application
2. Constructing a malicious serialized object (gadget chain) that triggers dangerous operations when deserialized
3. Sending the crafted payload to the vulnerable giftcontroller.php endpoint via the mylike parameter
4. The application deserializes the payload, triggering the gadget chain and executing attacker-controlled code

For detailed technical analysis and proof-of-concept information, refer to the Zhao Jin Note Sharing and VulDB Entry #250839.

Detection Methods for CVE-2024-0603

Indicators of Compromise

• Unusual HTTP requests targeting /app/plug/controller/giftcontroller.php or related gift controller endpoints
• Requests containing serialized PHP objects (look for patterns like O: or a: in URL parameters or POST data)
• Unexpected process spawning or network connections originating from the web server process
• Modifications to files outside normal CMS operations
• New or modified cron jobs, scheduled tasks, or persistence mechanisms

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
• Monitor access logs for requests to giftcontroller.php with suspicious mylike parameter values
• Deploy endpoint detection and response (EDR) solutions to detect post-exploitation activities
• Use intrusion detection systems (IDS) with signatures for PHP object injection attacks

Monitoring Recommendations

• Enable verbose logging for the ZhiCms application and monitor for deserialization-related errors
• Set up alerts for any access to the vulnerable giftcontroller.php endpoint
• Monitor for file system changes in web-accessible directories and application paths
• Track process execution chains originating from the PHP/web server process

How to Mitigate CVE-2024-0603

Immediate Actions Required

• Restrict access to the giftcontroller.php file if the gift functionality is not required
• Implement network-level access controls to limit exposure of the ZhiCms application
• Deploy WAF rules to block requests containing serialized PHP objects in the mylike parameter
• Consider taking the application offline until a patch is available or workarounds are implemented
• Conduct a security assessment to determine if the system has been compromised

Patch Information

At the time of this writing, vendor patch information is not available in the CVE data. Organizations should monitor the VulDB entry and official ZhiCms channels for security updates. If available, upgrade to a version of ZhiCms that addresses this vulnerability.

Workarounds

• Disable or remove the gift controller functionality by removing or renaming app/plug/controller/giftcontroller.php if not required
• Implement input validation at the web server level to reject requests with serialized data patterns
• Use PHP configuration options to restrict available classes for deserialization where possible
• Deploy a reverse proxy or WAF to filter malicious requests before they reach the application

# Example: Block access to vulnerable endpoint using Apache .htaccess
<Files "giftcontroller.php">
    Order Allow,Deny
    Deny from all
</Files>

# Example: Block access using Nginx configuration
location ~ /app/plug/controller/giftcontroller\.php {
    deny all;
    return 403;
}