CVE-2024-23052: 5kcrm Wukongcrm RCE Vulnerability

CVE-2024-23052 Overview

CVE-2024-23052 is a critical remote code execution vulnerability affecting WuKongOpenSource WukongCRM version 72crm_9.0.1_20191202. The vulnerability exists in the parseObject() function within the fastjson component, allowing remote attackers to execute arbitrary code on affected systems without authentication.

Critical Impact

This insecure deserialization vulnerability enables unauthenticated remote attackers to achieve complete system compromise through malicious JSON payloads processed by the vulnerable fastjson library.

Affected Products

• 5kcrm WukongCRM version 9.0.1_20191202

Discovery Timeline

• 2024-02-29 - CVE-2024-23052 published to NVD
• 2025-01-16 - Last updated in NVD database

Technical Details for CVE-2024-23052

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The fastjson library used by WukongCRM improperly handles deserialization of JSON data, allowing attackers to inject malicious class references that get instantiated during the parsing process. The parseObject() function fails to properly validate or restrict the types of objects that can be deserialized, creating an opportunity for attackers to leverage gadget chains present in the application's classpath.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Successful exploitation grants attackers the ability to execute arbitrary code with the same privileges as the WukongCRM application, potentially leading to complete system compromise including data theft, malware installation, and lateral movement within the network.

Root Cause

The root cause lies in the insecure implementation of the fastjson library's parseObject() function. Fastjson is a popular Java JSON parsing library that supports AutoType, a feature that allows JSON strings to specify which Java class should be instantiated during deserialization. Without proper type restrictions or allowlisting, attackers can craft malicious JSON payloads that reference dangerous classes, enabling remote code execution through known Java deserialization gadget chains.

Attack Vector

The vulnerability is exploitable via network-based attacks targeting endpoints that process JSON data through the vulnerable fastjson component. An attacker can craft a specially constructed JSON payload containing malicious type references that, when processed by the parseObject() function, instantiate dangerous Java classes. These classes can be chained together to achieve arbitrary command execution on the underlying server.

The attack requires no authentication and can be executed without any user interaction, making it particularly dangerous for internet-facing WukongCRM deployments. Common attack patterns involve leveraging JNDI lookup classes or other known fastjson deserialization gadgets to establish reverse shells or download and execute additional malicious payloads.

Detection Methods for CVE-2024-23052

Indicators of Compromise

• Unusual outbound network connections from the WukongCRM server to unknown IP addresses or domains
• Presence of unexpected Java processes or child processes spawned by the WukongCRM application
• Log entries showing malformed JSON requests with suspicious class references such as @type parameters
• Evidence of JNDI/LDAP/RMI connections originating from the application server

Detection Strategies

• Monitor HTTP request bodies for JSON payloads containing @type parameters with suspicious class references
• Implement network-based intrusion detection rules to identify known fastjson exploitation patterns
• Deploy Web Application Firewall (WAF) rules to block JSON deserialization attack payloads
• Review application logs for parsing errors or exceptions related to unknown class instantiation

Monitoring Recommendations

• Enable detailed logging for all JSON parsing operations within WukongCRM
• Configure alerts for outbound connections from the CRM server to non-whitelisted destinations
• Monitor Java process creation events for signs of command execution via deserialization attacks
• Implement behavioral analysis to detect anomalous activity patterns following JSON request processing

How to Mitigate CVE-2024-23052

Immediate Actions Required

• Immediately restrict network access to WukongCRM instances from untrusted networks
• Deploy Web Application Firewall rules to block requests containing suspicious @type JSON parameters
• Consider taking vulnerable instances offline until patching or mitigation is complete
• Review system logs for evidence of prior exploitation attempts

Patch Information

Organizations should upgrade to a patched version of WukongCRM that addresses this vulnerability. Review the GitHub Vulnerability Report and the GitHub Issue Discussion for specific patch information and updated versions. Additionally, consider upgrading the fastjson library to the latest secure version with AutoType disabled by default.

Workarounds

• Disable fastjson AutoType feature by configuring ParserConfig.getGlobalInstance().setAutoTypeSupport(false)
• Implement strict input validation and filtering for all JSON endpoints
• Deploy network segmentation to limit exposure of vulnerable WukongCRM instances
• Use application-level allowlisting to restrict deserializable class types

# Configuration example - Disable fastjson AutoType in Java application
# Add to application startup parameters or configuration
-Dfastjson.parser.autoTypeSupport=false

# Or configure in application code before any JSON parsing
# ParserConfig.getGlobalInstance().setAutoTypeSupport(false);