CVE-2024-1651: Torrentpier RCE Vulnerability

CVE-2024-1651 Overview

CVE-2024-1651 is a critical insecure deserialization vulnerability in TorrentPier version 2.4.1 that allows unauthenticated remote attackers to execute arbitrary commands on the server. The vulnerability exists because the application improperly handles deserialization of user-supplied data, enabling attackers to inject malicious serialized objects that are processed without proper validation.

Critical Impact

This vulnerability enables complete server compromise through arbitrary command execution. Attackers can gain full control over the affected TorrentPier installation, potentially leading to data exfiltration, malware deployment, lateral movement within the network, and use of the compromised server for further attacks.

Affected Products

• TorrentPier version 2.4.1
• TorrentPier installations running vulnerable deserialization components

Discovery Timeline

• 2024-02-20 - CVE-2024-1651 published to NVD
• 2025-02-12 - Last updated in NVD database

Technical Details for CVE-2024-1651

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) in TorrentPier 2.4.1 allows attackers to execute arbitrary commands on the server without authentication. Insecure deserialization occurs when an application deserializes untrusted data without proper validation, allowing attackers to manipulate serialized objects to achieve malicious outcomes.

In PHP applications like TorrentPier, this typically involves exploiting the unserialize() function with malicious serialized objects. When the application processes these objects, attackers can leverage PHP's magic methods (such as __wakeup(), __destruct(), or __toString()) to trigger code execution chains known as "POP chains" (Property-Oriented Programming).

The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous for exposed TorrentPier installations.

Root Cause

The root cause of this vulnerability is the application's failure to properly validate or sanitize serialized data before passing it to PHP's unserialize() function. TorrentPier 2.4.1 accepts user-controlled serialized input and processes it without implementing adequate security controls such as:

• Input validation before deserialization
• Restricting allowed classes during deserialization
• Using safe serialization alternatives like JSON

This allows attackers to craft malicious serialized payloads that exploit available gadget chains within the application or its dependencies.

Attack Vector

The attack is conducted remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying the vulnerable TorrentPier endpoint that processes serialized data
2. Crafting a malicious serialized PHP object containing a command execution payload
3. Sending the payload to the vulnerable endpoint
4. The server deserializes the malicious object, triggering the command execution

The vulnerability allows arbitrary command execution with the privileges of the web server process, potentially enabling full server compromise. For detailed technical analysis and proof-of-concept information, refer to the FluidAttacks Security Advisory.

Detection Methods for CVE-2024-1651

Indicators of Compromise

• Unusual HTTP requests containing serialized PHP objects (look for patterns like O: followed by class names and properties)
• Unexpected child processes spawned by the web server process (e.g., PHP-FPM spawning shell commands)
• Anomalous file system activity from the web server user, including creation of new files in unexpected locations
• Network connections initiated by the web server to external hosts that may indicate reverse shell activity
• Suspicious entries in web server access logs with base64-encoded or URL-encoded serialized payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP requests
• Monitor web server process activity for unexpected command execution or child process spawning
• Deploy file integrity monitoring on the TorrentPier installation directory to detect unauthorized modifications
• Configure intrusion detection systems (IDS) to alert on patterns associated with PHP deserialization attacks
• Review web server logs for requests containing suspicious serialized data patterns

Monitoring Recommendations

• Enable detailed logging for the TorrentPier application and web server
• Configure alerting for any command execution attempts originating from the web server process
• Monitor outbound network connections from the server hosting TorrentPier for potential data exfiltration or reverse shell activity
• Implement application-level logging to track deserialization operations

How to Mitigate CVE-2024-1651

Immediate Actions Required

• Upgrade TorrentPier to the latest available version that addresses this vulnerability
• If an immediate upgrade is not possible, consider taking the TorrentPier application offline until patching is complete
• Restrict network access to the TorrentPier installation using firewall rules to limit exposure
• Review server logs for evidence of exploitation attempts
• Audit the server for any signs of compromise if the vulnerable version was exposed to the internet

Patch Information

Users should upgrade to a patched version of TorrentPier. Check the TorrentPier GitHub repository for the latest releases and security updates. The FluidAttacks Security Advisory provides additional technical details about this vulnerability.

Workarounds

• Place the TorrentPier application behind a Web Application Firewall (WAF) configured to detect and block serialized PHP object injection attempts
• Implement network segmentation to isolate the TorrentPier server from critical infrastructure
• Restrict access to the TorrentPier installation to trusted IP addresses only using firewall rules
• Consider running TorrentPier in a containerized environment with limited privileges and restricted system access
• Disable or remove any unnecessary features that may process serialized data

# Example: Restrict access to TorrentPier using iptables
# Allow access only from trusted IP ranges
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP