CVE-2024-1750: TemmokuMVC RCE Vulnerability

CVE-2024-1750 Overview

CVE-2024-1750 is an insecure deserialization vulnerability in TemmokuMVC versions up to 2.3. The flaw resides in the get_img_url and img_replace functions within lib/images_get_down.php, part of the Image Download Handler component. Attackers can trigger deserialization of untrusted data remotely without authentication. Exploitation requires high attack complexity, and the public disclosure includes technical details. The vendor was contacted prior to publication but did not respond. This issue is tracked as VDB-254532 and maps to CWE-502: Deserialization of Untrusted Data.

Critical Impact
Successful exploitation can compromise confidentiality, integrity, and availability of the host running TemmokuMVC, with potential for arbitrary object instantiation and code execution through PHP gadget chains.

Affected Products

TemmokuMVC versions up to and including 2.3
lib/images_get_down.php library component
Image Download Handler functions get_img_url and img_replace

Discovery Timeline

2024-02-22 - CVE-2024-1750 published to NVD
2024-12-31 - Last updated in NVD database

Technical Details for CVE-2024-1750

Vulnerability Analysis

The vulnerability stems from unsafe handling of attacker-controlled input passed into PHP deserialization routines within the Image Download Handler. When the get_img_url or img_replace functions process remote image references, the application deserializes data without validating its source or structure. PHP's unserialize() invokes magic methods such as __wakeup, __destruct, and __toString on reconstructed objects, allowing gadget chains to execute arbitrary operations. The attack vector is network-based and requires no authentication or user interaction, although the exploitation complexity is rated high.

Root Cause

The root cause is the application accepting serialized PHP data from untrusted sources and passing it directly to unserialize() without integrity checks or allow-listed class restrictions. [CWE-502] vulnerabilities of this kind become exploitable when usable gadget chains exist in the application's class hierarchy or its dependencies.

Attack Vector

A remote attacker crafts a malicious serialized payload and submits it through the image URL parameters processed by get_img_url or img_replace. When TemmokuMVC deserializes the payload, instantiated objects trigger magic methods that can lead to file writes, command execution, or further compromise. No prior credentials or user interaction are required. See the Zhao Jin technical write-up and VulDB entry #254532 for technical details on the payload structure.

Detection Methods for CVE-2024-1750

Indicators of Compromise

Inbound HTTP requests containing serialized PHP markers such as O:, a:, or s: in image URL parameters processed by TemmokuMVC
Unexpected child processes spawned by the PHP interpreter (php-fpm, php-cgi) running on the TemmokuMVC host
New or modified PHP files in web-accessible directories shortly after image download requests
Outbound network connections originating from the web server to attacker-controlled infrastructure

Detection Strategies

Inspect web server access logs for requests targeting endpoints that invoke get_img_url or img_replace with abnormally long or base64-encoded parameters
Deploy WAF rules that flag serialized PHP object patterns in query strings and POST bodies
Correlate PHP process activity with file system writes and outbound network connections using endpoint telemetry

Monitoring Recommendations

Enable PHP error logging and monitor for unserialize() warnings referencing images_get_down.php
Track creation of webshells or unexpected executable scripts in the TemmokuMVC web root
Alert on anomalous outbound DNS or HTTP traffic from the web server

How to Mitigate CVE-2024-1750

Immediate Actions Required

Restrict network exposure of TemmokuMVC instances and place them behind authenticated reverse proxies
Disable or remove the Image Download Handler functionality if it is not required for production use
Audit lib/images_get_down.php for direct calls to unserialize() on user-supplied data and refactor to use JSON or signed payloads
Review web server and application logs for prior exploitation attempts matching the indicators above

Patch Information

The vendor did not respond to the disclosure, and no official patch is available at the time of publication. Operators should apply the workarounds below and consider migrating to a maintained framework. Track updates on the VulDB advisory for any future remediation guidance.

Workarounds

Replace unserialize() calls with json_decode() and switch any persisted state to JSON or another safe format
If unserialize() must be used, pass an allowed_classes allow-list to constrain object instantiation
Deploy a web application firewall rule blocking serialized PHP object signatures in HTTP parameters
Run the TemmokuMVC PHP process with least-privilege file system permissions to limit post-exploitation impact

bash

# Example WAF rule (ModSecurity) blocking serialized PHP objects in query strings
SecRule ARGS "@rx O:[0-9]+:\"[a-zA-Z_\\x7f-\\xff][a-zA-Z0-9_\\x7f-\\xff]*\":[0-9]+:" \
    "id:1002024,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential PHP object injection targeting CVE-2024-1750'"