CVE-2024-54135: Oxygenz ClipBucket RCE Vulnerability

CVE-2024-54135 Overview

CVE-2024-54135 is a PHP deserialization vulnerability in ClipBucket V5, an open source video hosting platform. The flaw resides in upload/photo_upload.php within the decode_key function. User-supplied input from the collection GET parameter and photoIDS POST parameter reaches the unserialize call defined in upload/includes/classes/photos.class.php without sanitization. Authenticated attackers can inject crafted PHP serialized objects and leverage gadget chains to trigger arbitrary application behavior. The vulnerability affects ClipBucket-v5 Version 2.0 through Version 5.5.1 Revision 199 and is fixed in Revision 200.

Critical Impact
Attackers with low privileges can achieve remote code execution against confidentiality, integrity, and availability through crafted serialized payloads.

Affected Products

Oxygenz ClipBucket V5 version 2.0 through 5.5.1 Revision 199
upload/photo_upload.php component
upload/includes/classes/photos.class.php component

Discovery Timeline

2024-12-06 - CVE-2024-54135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54135

Vulnerability Analysis

The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data]. ClipBucket V5 uses PHP's native serialize/unserialize functions to encode and decode keys for photo upload operations. The encode_key function base64-encodes a serialized PHP object, and the decode_key function reverses the process by base64-decoding attacker-controlled input and passing it directly to unserialize.

Because unserialize reconstructs arbitrary PHP objects with their magic methods intact (for example __wakeup, __destruct, __toString), an attacker who can supply a serialized payload can chain existing application or library classes into a gadget chain. This chain can produce arbitrary side effects, including file writes, command execution, or object property manipulation.

Root Cause

The root cause is unsafe deserialization of user-controlled data. The collection GET parameter and photoIDS POST parameter flow into decode_key without any type validation, HMAC verification, or origin check before reaching unserialize. The application trusts base64-encoded input from the request as if it originated from the server.

Attack Vector

Exploitation requires network access and a low-privileged authenticated account. The attacker crafts a PHP-serialized gadget chain, base64-encodes it, and submits it through the collection or photoIDS parameter of the photo upload endpoint. On deserialization, the gadget chain executes, allowing the attacker to compromise the hosting server.

php

     *
     * @return string
     */
-    function encode_key($key)
+    function encode_key($key): string
    {
-        return base64_encode(serialize($key));
+        return base64_encode(json_encode($key));
    }

Source: ClipBucket V5 patch commit 76a829c0. The fix replaces serialize/unserialize with json_encode/json_decode, eliminating object instantiation from untrusted input.

Detection Methods for CVE-2024-54135

Indicators of Compromise

HTTP requests to photo_upload.php containing suspiciously long or non-standard base64 values in the collection GET parameter or photoIDS POST parameter.
Base64-decoded request parameters that begin with PHP serialization markers such as O:, a:, or s:.
Unexpected child processes spawned by the PHP-FPM or web server process after photo upload requests.
New or modified files under the ClipBucket upload/ directory that do not correspond to legitimate media uploads.

Detection Strategies

Inspect web server access logs for POST and GET requests to /upload/photo_upload.php and decode the collection and photoIDS parameter values for serialized PHP object signatures.
Deploy a web application firewall rule that blocks request parameters whose base64-decoded content contains unserialize gadget indicators such as class names ending in known exploitable suffixes.
Enable PHP audit logging or an extension such as Snuffleupagus to alert on unserialize calls receiving user-tainted input.

Monitoring Recommendations

Monitor the ClipBucket installation for version drift and confirm the deployed revision is 5.5.1 Revision 200 or later.
Alert on outbound network connections initiated by the PHP web server process, which may indicate post-exploitation callbacks.
Track file integrity of upload/photo_upload.php and upload/includes/classes/photos.class.php to detect tampering or downgrade attempts.

How to Mitigate CVE-2024-54135

Immediate Actions Required

Upgrade ClipBucket V5 to version 5.5.1 Revision 200 or later, which replaces unserialize with json_decode in the affected code path.
Audit web server and application logs for prior exploitation attempts against photo_upload.php since the vulnerable code has existed since version 2.0.
Rotate application secrets, database credentials, and administrator passwords if exploitation is suspected.

Patch Information

The vendor patch is available in commit 76a829c088f0813ab3244a3bd0036111017409b0, published as part of ClipBucket-v5 Version 5.5.1 Revision 200. See the GitHub Security Advisory GHSA-4523-mqmv-wrqx for advisory details and the patch commit on GitHub for the code change.

Workarounds

Restrict access to /upload/photo_upload.php at the reverse proxy or web application firewall to trusted authenticated sessions only.
Deploy a WAF rule that rejects requests where the collection or photoIDS parameter base64-decodes to content beginning with PHP serialization markers.
Disable the photo upload functionality until the patched revision can be deployed if immediate upgrade is not possible.

bash

# Example WAF rule (ModSecurity) to block PHP serialized payloads in vulnerable parameters
SecRule ARGS:collection|ARGS:photoIDS "@rx (?i)(?:^|[^A-Za-z0-9+/=])(?:Tzo|YTo|czo)[A-Za-z0-9+/=]{4,}" \
    "id:1054135,phase:2,deny,status:403,\
    msg:'CVE-2024-54135 ClipBucket PHP serialized payload detected',\
    logdata:'Param: %{MATCHED_VAR_NAME} Value: %{MATCHED_VAR}'"