CVE-2024-11145: Easy Folder Listing Pro RCE Vulnerability

CVE-2024-11145 Overview

CVE-2024-11145 is a critical insecure deserialization vulnerability affecting Valor Apps Easy Folder Listing Pro, a Joomla! extension used for displaying folder and file listings on websites. This vulnerability allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application, potentially leading to complete system compromise.

Critical Impact

Unauthenticated remote code execution vulnerability allows attackers to fully compromise Joomla! installations running vulnerable versions of Easy Folder Listing Pro without requiring any user interaction or authentication.

Affected Products

• Valor Apps Easy Folder Listing Pro versions prior to 3.8
• Valor Apps Easy Folder Listing Pro versions prior to 4.5
• Valor Apps Easy Folder Listing Pro 3.7 (confirmed vulnerable)

Discovery Timeline

• 2024-11-26 - CVE-2024-11145 published to NVD
• 2025-09-23 - Last updated in NVD database

Technical Details for CVE-2024-11145

Vulnerability Analysis

This vulnerability stems from improper handling of serialized data within the Easy Folder Listing Pro Joomla! extension. The application fails to properly validate and sanitize serialized input before deserializing it, creating an insecure deserialization condition classified under CWE-502 (Deserialization of Untrusted Data).

When a Joomla! extension deserializes user-controlled data without adequate validation, an attacker can craft malicious serialized objects that, upon deserialization, trigger unintended code execution. In PHP-based applications like Joomla!, this typically involves exploiting gadget chains—sequences of existing classes whose methods are automatically invoked during the deserialization process.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without authentication. The impact is severe: successful exploitation grants the attacker the ability to execute arbitrary commands with the same privileges as the Joomla! web application, typically the web server user account.

Root Cause

The root cause of CVE-2024-11145 is the insecure deserialization of untrusted data (CWE-502). The Easy Folder Listing Pro extension accepts serialized PHP objects from user input without implementing proper validation, type checking, or integrity verification. This allows attackers to inject malicious serialized payloads that execute arbitrary code when processed by PHP's unserialize() function or similar deserialization mechanisms.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying Joomla! installations with vulnerable versions of Easy Folder Listing Pro
2. Crafting a malicious serialized PHP object payload containing a gadget chain
3. Sending the payload to the vulnerable endpoint via HTTP request
4. The application deserializes the malicious object, triggering code execution

The deserialization vulnerability in Easy Folder Listing Pro allows attackers to submit crafted serialized PHP objects through network requests. Upon deserialization, these objects can leverage existing PHP classes (gadget chains) present in Joomla! or its extensions to achieve arbitrary code execution. The attacker constructs a payload containing object properties that, when automatically processed during deserialization via magic methods like __wakeup() or __destruct(), execute system commands or PHP code with web server privileges.

For additional technical details, see the CISA CSAF Advisory.

Detection Methods for CVE-2024-11145

Indicators of Compromise

• Unusual HTTP POST requests to Joomla! Easy Folder Listing Pro endpoints containing serialized PHP object patterns (e.g., O: followed by class names)
• Web server logs showing requests with base64-encoded or URL-encoded serialized data targeting extension endpoints
• Unexpected processes spawned by the web server user (e.g., www-data, apache, nginx)
• New or modified files in the Joomla! web directory, particularly PHP files with suspicious content
• Outbound network connections from the web server to unknown external hosts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing PHP serialized object patterns
• Monitor web server access logs for suspicious POST requests targeting Easy Folder Listing Pro component URLs
• Deploy file integrity monitoring on Joomla! installation directories to detect unauthorized modifications
• Use intrusion detection systems (IDS) with signatures for PHP deserialization attack patterns

Monitoring Recommendations

• Enable verbose logging for the Joomla! application and web server
• Configure SIEM alerts for patterns associated with PHP object injection attempts
• Monitor for anomalous web server process behavior including unexpected child processes or system calls
• Review Joomla! administrator activity logs for unauthorized access following potential exploitation

How to Mitigate CVE-2024-11145

Immediate Actions Required

• Upgrade Easy Folder Listing Pro to version 3.8 or 4.5 (depending on your major version branch) immediately
• Audit Joomla! installations for signs of compromise before and after patching
• Review web server and application logs for evidence of exploitation attempts
• Consider temporarily disabling the Easy Folder Listing Pro extension if immediate patching is not possible

Patch Information

Valor Apps has released patched versions of Easy Folder Listing Pro that address this deserialization vulnerability. Users should update to version 3.8 for the 3.x branch or version 4.5 for the 4.x branch. The updated versions are available from the Valor Apps Product Page.

Workarounds

• Disable or uninstall the Easy Folder Listing Pro extension until patching is possible
• Implement WAF rules to block requests containing serialized PHP object patterns to Joomla! endpoints
• Restrict network access to the Joomla! installation using IP allowlisting where feasible
• Run the Joomla! application with minimal filesystem and system privileges to limit post-exploitation impact

# Example: Disable the extension via Joomla! CLI (Joomla 4+)
php cli/joomla.php extension:disable com_easyfolderlistingpro

# Verify current extension version
php cli/joomla.php extension:list | grep -i folder