CVE-2024-10749: ThinkAdmin Deserialization RCE Vulnerability

CVE-2024-10749 Overview

CVE-2024-10749 is an insecure deserialization vulnerability in ThinkAdmin versions up to 6.1.67. The flaw resides in the script function of the file /app/admin/controller/api/Plugs.php, where manipulation of the uptoken argument leads to unsafe object deserialization [CWE-502]. The issue can be triggered remotely over the network, but the exploit complexity is high and exploitability is described as difficult. The exploit has been publicly disclosed. According to the disclosure record, the vendor was contacted before publication but did not respond.

Critical Impact
Remote attackers with low privileges can submit a crafted uptoken value to invoke PHP object deserialization, potentially leading to limited compromise of confidentiality, integrity, and availability within the ThinkAdmin application context.

Affected Products

ThinkAdmin up to and including version 6.1.67
Component: /app/admin/controller/api/Plugs.php
Vulnerable function: script

Discovery Timeline

2024-11-04 - CVE-2024-10749 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10749

Vulnerability Analysis

ThinkAdmin is a PHP-based backend management framework built on ThinkPHP. The vulnerable code path lives in the script function of /app/admin/controller/api/Plugs.php, which processes the uptoken request parameter. That parameter is passed into a deserialization routine without prior integrity or type validation. As a result, an attacker can supply a serialized PHP object that triggers arbitrary property assignment and magic method execution during object reconstruction.

The attack requires the request to reach the vulnerable endpoint over the network, and it requires low-level authenticated privileges. Attack complexity is high because exploitation depends on the presence of usable gadget chains within the application or its dependencies. Successful exploitation can influence application logic, tamper with stored data, or trigger side effects through gadget-driven method calls.

Root Cause

The root cause is unsafe use of PHP's unserialize() (or equivalent framework deserialization primitive) on attacker-controlled input passed through the uptoken parameter. There is no signature, type filter, or allow-list guarding which classes may be instantiated during deserialization, which is the classic pattern captured by CWE-502.

Attack Vector

An authenticated attacker sends an HTTP request to the ThinkAdmin admin API route that dispatches to Plugs.php::script, placing a crafted, base64-encoded serialized PHP object in the uptoken parameter. When the controller decodes and deserializes the value, PHP reconstructs the attacker-supplied object graph and invokes magic methods such as __wakeup, __destruct, or __toString on gadget classes reachable from the application autoloader. The specific impact depends on the gadget chain identified in ThinkAdmin, ThinkPHP, or third-party Composer dependencies. Public exploit documentation is referenced on GitHub and VulDB entry 282918.

Detection Methods for CVE-2024-10749

Indicators of Compromise

HTTP requests to admin API routes handled by Plugs.php containing an uptoken parameter with base64-encoded PHP serialized data (values beginning with patterns that decode to O: or a: markers).
Unexpected outbound network connections, file writes under runtime/, or new PHP files under web-accessible directories originating from the PHP-FPM or web server process.
PHP error log entries referencing unserialize(), __wakeup, or class-not-found exceptions tied to admin API requests.

Detection Strategies

Inspect web server access logs for POST or GET requests to ThinkAdmin admin API endpoints that pass a large or base64-encoded uptoken value.
Deploy web application firewall (WAF) rules that flag serialized PHP object markers (O:\d+:, a:\d+:{) appearing in the uptoken parameter.
Correlate suspicious uptoken requests with subsequent process creation, file writes, or outbound connections from the web server host.

Monitoring Recommendations

Enable PHP error and audit logging with alerting on deserialization-related warnings triggered by admin API routes.
Monitor authenticated admin sessions for anomalous request patterns targeting /api/Plugs endpoints.
Baseline the ThinkAdmin runtime/ and web root directories and alert on unexpected file creation or modification.

How to Mitigate CVE-2024-10749

Immediate Actions Required

Upgrade ThinkAdmin to a release later than 6.1.67 once the maintainer publishes a fixed version, and monitor the ThinkAdmin project for advisories.
Restrict access to ThinkAdmin admin endpoints to trusted IP ranges or VPN-only networks until a patch is available.
Rotate administrative credentials and API tokens if suspicious uptoken traffic is found in logs.

Patch Information

At the time of NVD publication, the vendor had not responded to the disclosure and no official patch reference is listed. Track the VulDB entry 282918 and the upstream ThinkAdmin repository for a corrective release. Until then, treat all deployments up to and including 6.1.67 as vulnerable.

Workarounds

Apply WAF rules that reject requests where the uptoken parameter decodes to PHP serialized object markers.
Enforce authentication and role checks on the affected admin API route and limit reachability to internal networks.
If feasible, patch the controller locally to validate uptoken as an opaque string and remove any call path leading to unserialize() on user input; use signed JSON tokens instead.

bash

# Example nginx location block restricting ThinkAdmin admin API to an internal CIDR
location ~ ^/admin/api/Plugs {
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}