CVE-2024-46084: Scriptcase RCE Vulnerability via nm_unzip

CVE-2024-46084 Overview

CVE-2024-46084 is a remote code execution (RCE) vulnerability affecting Scriptcase versions 9.10.023 and earlier. The flaw resides in the nm_unzip function, which handles archive extraction within the Scriptcase low-code development platform. Attackers with low-level privileges can leverage improper input handling in this function to execute arbitrary operating system commands on the underlying host. The vulnerability is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command). Scriptcase is widely used to generate PHP applications, forms, and reports, so a compromise typically exposes application source code, database credentials, and connected backend systems.

Critical Impact

Authenticated attackers can achieve remote code execution on Scriptcase servers through the nm_unzip function, leading to full compromise of hosted applications and connected databases.

Affected Products

• Scriptcase 9.10.023 and all prior 9.x releases
• Deployments exposing the Scriptcase development environment over the network
• Scriptcase instances where authenticated users can trigger archive upload or extraction operations

Discovery Timeline

• 2024-10-01 - CVE-2024-46084 published to the National Vulnerability Database
• 2026-07-05 - Last updated in NVD database

Technical Details for CVE-2024-46084

Vulnerability Analysis

The vulnerability is a command injection flaw in the nm_unzip function of Scriptcase. The function processes archive filenames or extraction parameters without properly neutralizing shell metacharacters. When user-controlled input reaches the underlying command execution path, attackers can append or inject arbitrary operating system commands. Successful exploitation gives the attacker code execution in the context of the web server user, typically providing access to the Scriptcase project directory, generated PHP applications, and stored database connection strings. From that foothold, adversaries can pivot to connected databases and internal services.

Root Cause

The root cause is improper neutralization of special elements passed to a command interpreter, mapped to [CWE-77]. The nm_unzip routine constructs a system-level command using attacker-influenced input without adequate escaping or a safe API such as parameterized process invocation. Any filename or path containing shell metacharacters is interpreted by the shell rather than treated as literal data.

Attack Vector

Exploitation requires network access to a Scriptcase instance and low-privilege authenticated access, along with a user interaction step to trigger the vulnerable extraction workflow. An attacker crafts a request that reaches nm_unzip with a payload embedding shell operators such as ;, &&, or backticks. The injected commands execute on the server, allowing the attacker to spawn reverse shells, drop web shells, or read sensitive configuration files. For technical exploitation details, see the Hawk Testers RCE Vulnerability Alert.

Detection Methods for CVE-2024-46084

Indicators of Compromise

• Unexpected child processes such as sh, bash, cmd.exe, or powershell.exe spawned from the PHP or web server process running Scriptcase.
• New or modified files under the Scriptcase web root, particularly PHP files placed outside standard project directories.
• Outbound network connections from the Scriptcase host to unfamiliar external IP addresses shortly after archive upload or extraction activity.
• HTTP requests to Scriptcase endpoints containing shell metacharacters (;, |, &, backticks) in filename or path parameters.

Detection Strategies

• Monitor process ancestry for the web server user; any shell interpreter spawned as a child of the PHP process warrants investigation.
• Inspect web server access logs for requests targeting Scriptcase upload or extraction handlers with abnormal payloads in query strings or POST bodies.
• Correlate archive upload events with subsequent file writes to the web root and outbound connections to catch multi-stage exploitation.

Monitoring Recommendations

• Enable verbose PHP and web server logging on Scriptcase hosts and forward logs to a centralized SIEM for correlation.
• Baseline normal Scriptcase user activity to flag deviations such as archive uploads from unusual accounts or IP ranges.
• Alert on any execution of system utilities (wget, curl, nc, bash -i) originating from the Scriptcase application user.

How to Mitigate CVE-2024-46084

Immediate Actions Required

• Upgrade Scriptcase to a version later than 9.10.023 that addresses the nm_unzip command injection flaw.
• Restrict network access to Scriptcase management and development interfaces to trusted administrative networks or VPN users only.
• Audit Scriptcase user accounts and revoke any low-privilege accounts that are no longer required, since exploitation requires authenticated access.
• Review Scriptcase hosts for signs of prior compromise, including unexpected PHP files and unauthorized outbound connections.

Patch Information

Scriptcase users should upgrade to a release later than 9.10.023. Consult the Hawk Testers advisory and the Scriptcase vendor release notes for the specific fixed build. No dedicated vendor advisory URL is available in the NVD record at the time of publication.

Workarounds

• Place Scriptcase behind a web application firewall configured to block requests containing shell metacharacters in upload-related parameters.
• Disable archive upload and extraction features for non-administrative accounts if the deployment supports role-based restriction.
• Run the Scriptcase web server process as an unprivileged user in a hardened container to limit the blast radius of successful exploitation.