CVE-2024-1225: Qibosoft Qibocms X1 RCE Vulnerability

CVE-2024-1225 Overview

A critical insecure deserialization vulnerability has been identified in QiboSoft QiboCMS X1 versions up to 1.0.6. This vulnerability exists in the rmb_pay function within the file /application/index/controller/Pay.php. An attacker can exploit this flaw by manipulating the callback_class argument, leading to arbitrary object deserialization. The attack can be launched remotely without authentication, potentially allowing complete system compromise.

Critical Impact

Remote attackers can exploit this deserialization vulnerability to execute arbitrary code on affected QiboCMS X1 installations, potentially leading to complete server compromise, data theft, and lateral movement within the network.

Affected Products

• QiboSoft QiboCMS X1 versions up to and including 1.0.6

Discovery Timeline

• 2024-02-05 - CVE-2024-1225 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1225

Vulnerability Analysis

This vulnerability falls under the category of Insecure Deserialization (CWE-502). The rmb_pay function in the Pay.php controller fails to properly validate or sanitize user-controlled input before deserializing it. When the callback_class parameter is manipulated by an attacker, the application deserializes untrusted data, which can lead to arbitrary code execution.

PHP object deserialization vulnerabilities are particularly dangerous because they can be chained with existing class methods (known as "gadget chains") to achieve various malicious outcomes including remote code execution, file system access, or database manipulation.

Root Cause

The root cause of this vulnerability is the improper handling of user-supplied input in the deserialization process. The callback_class argument is passed to a deserialization function without adequate validation or sanitization. PHP's unserialize() function, when used with untrusted data, can instantiate arbitrary objects and invoke their magic methods (such as __wakeup(), __destruct(), or __toString()), enabling attackers to execute malicious code.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker can craft a malicious serialized PHP object payload and submit it through the callback_class parameter to the /application/index/controller/Pay.php endpoint. No authentication is required to exploit this vulnerability, and no user interaction is needed.

The attack flow typically involves:

1. Identifying available PHP classes in the application or its dependencies that contain exploitable magic methods
2. Constructing a serialized object payload that chains these classes together (POP chain)
3. Sending the malicious payload via the callback_class parameter to the vulnerable endpoint
4. Upon deserialization, the crafted object triggers code execution through the gadget chain

For additional technical details, refer to the Zhao Jin security note and the VulDB advisory.

Detection Methods for CVE-2024-1225

Indicators of Compromise

• Unusual HTTP requests to /application/index/controller/Pay.php containing serialized PHP objects in the callback_class parameter
• Web server logs showing requests with encoded or serialized object patterns (e.g., O: prefix indicating PHP serialized objects)
• Unexpected process spawning or command execution from the PHP web server process
• Anomalous file creation or modification in web-accessible directories

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP parameters
• Monitor web application logs for suspicious requests targeting the Pay.php controller with unusual callback_class values
• Deploy file integrity monitoring on QiboCMS installation directories to detect unauthorized modifications
• Use endpoint detection and response (EDR) solutions like SentinelOne to identify post-exploitation activities

Monitoring Recommendations

• Enable verbose logging for the QiboCMS application and web server access logs
• Configure alerts for any requests containing serialized object patterns (regex: O:[0-9]+:")
• Monitor for unexpected outbound connections from the web server that may indicate reverse shell attempts
• Track process ancestry to identify suspicious child processes spawned by the web server

How to Mitigate CVE-2024-1225

Immediate Actions Required

• Upgrade QiboCMS X1 to a version later than 1.0.6 if a patch is available from the vendor
• If no patch is available, consider temporarily disabling or restricting access to the affected Pay.php functionality
• Implement network-level access controls to limit exposure of the vulnerable endpoint
• Deploy WAF rules to filter malicious serialized object payloads

Patch Information

At the time of disclosure, QiboSoft was contacted but did not respond. Users should check the official QiboSoft website or repositories for any available security updates. If no official patch is available, the workarounds below should be implemented immediately.

Workarounds

• Restrict access to the /application/index/controller/Pay.php endpoint using server configuration or firewall rules
• Implement input validation on the callback_class parameter to allow only expected, whitelisted values
• Consider deploying a reverse proxy with request filtering capabilities to sanitize incoming requests
• Use SentinelOne's runtime protection capabilities to detect and block exploitation attempts

# Example: Restrict access to the vulnerable endpoint using Apache .htaccess
# Add to .htaccess in the application root directory
<Files "Pay.php">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
</Files>