CVE-2024-24724: Gibbonedu Gibbon RCE Vulnerability

CVE-2024-24724 Overview

CVE-2024-24724 is a critical Server-Side Template Injection (SSTI) vulnerability affecting Gibbon, an open-source school management platform. The vulnerability exists in the /modules/School%20Admin/messengerSettings.php endpoint where user-supplied input is passed directly to the Twig template engine without proper sanitization. This flaw allows unauthenticated remote attackers to inject malicious template directives that execute arbitrary code on the server, potentially leading to complete system compromise.

Critical Impact

Unauthenticated remote code execution via Server-Side Template Injection in Gibbon's messenger settings module, enabling attackers to gain full control of affected school management systems.

Affected Products

• Gibbon through version 26.0.00
• GibbonEdu Gibbon (all versions up to and including 26.0.00)
• School management systems running vulnerable Gibbon installations

Discovery Timeline

• 2024-04-03 - CVE CVE-2024-24724 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2024-24724

Vulnerability Analysis

This vulnerability represents a classic Server-Side Template Injection flaw in the Twig templating engine context. The messengerSettings.php file processes user input and passes it to Twig for rendering without implementing proper input validation or output encoding. Twig, like many modern template engines, allows for powerful expressions that can access underlying system functionality when exploited.

The attack can be executed remotely over the network without requiring authentication, user interaction, or special privileges. Successful exploitation provides attackers with the ability to read and write arbitrary files, execute system commands, and potentially pivot to other systems on the network. Given that Gibbon is used by educational institutions, compromised systems may expose sensitive student and staff data.

Root Cause

The root cause of CVE-2024-24724 is improper input validation in the messengerSettings.php module. User-controllable data is concatenated or interpolated directly into Twig template strings without sanitization. Twig's expression syntax (using {{ }} and {% %} delimiters) can be exploited to execute arbitrary PHP code when attacker-controlled input reaches the template rendering process.

The vulnerability falls under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), which specifically addresses scenarios where template engines receive untrusted input that can manipulate template logic.

Attack Vector

The attack is network-accessible through the School Admin module's messenger settings functionality. An attacker crafts a malicious HTTP request to the /modules/School%20Admin/messengerSettings.php endpoint containing Twig template injection payloads. Common SSTI payloads for Twig leverage the _self.env object or filter functions to achieve code execution.

Typical exploitation involves injecting Twig expressions that call PHP functions or access the underlying environment object. For example, attackers may attempt to use Twig's filter function combined with system execution functions to run arbitrary commands on the host operating system.

For detailed technical exploitation information, refer to the Packet Storm Security advisory.

Detection Methods for CVE-2024-24724

Indicators of Compromise

• Unusual HTTP requests to /modules/School%20Admin/messengerSettings.php containing Twig syntax delimiters ({{, }}, {%, %})
• Web server logs showing requests with encoded template expressions in URL parameters or POST data
• Unexpected process executions spawned by the web server process (e.g., php-fpm or apache2 spawning shell commands)
• Modifications to system files or unexpected network connections from the Gibbon server

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SSTI payloads targeting Twig template syntax
• Implement application-level logging to capture all requests to administrative endpoints and flag suspicious input patterns
• Monitor for process ancestry anomalies where web server workers spawn unexpected child processes
• Use file integrity monitoring on the Gibbon installation directory to detect unauthorized modifications

Monitoring Recommendations

• Enable verbose logging for the Gibbon application and forward logs to a centralized SIEM for correlation
• Set up alerts for HTTP 500 errors on the messengerSettings.php endpoint, which may indicate attempted exploitation
• Monitor outbound network traffic from the Gibbon server for unexpected connections that could indicate reverse shell activity
• Regularly audit user accounts and administrative access to detect potential persistence mechanisms

How to Mitigate CVE-2024-24724

Immediate Actions Required

• Immediately restrict access to the /modules/School%20Admin/messengerSettings.php endpoint through network controls or authentication requirements
• Update Gibbon to a patched version beyond 26.0.00 when available from the GibbonEdu download page
• Conduct a forensic review of web server logs to identify any exploitation attempts
• Isolate affected Gibbon servers from sensitive network segments until patching is complete

Patch Information

Organizations should monitor the GibbonEdu official download page for security updates addressing this vulnerability. Apply patches immediately upon availability, following proper change management procedures. Before updating production systems, test patches in a staging environment to verify compatibility with existing configurations.

Workarounds

• Implement a reverse proxy or WAF rule to block requests containing Twig template syntax characters in parameters
• Restrict access to the School Admin module to trusted IP addresses only using web server configuration
• Disable the messenger settings functionality if not required for operations until a patch is available
• Apply input validation at the web server level using mod_security or similar modules to filter malicious payloads

If using Apache with mod_security, consider implementing rules that block common SSTI patterns. For nginx, use location blocks with access restrictions to limit exposure of the vulnerable endpoint. Consult your web server documentation for specific configuration syntax appropriate to your deployment.