CVE-2024-6469: PlaySMS 1.4.3 RCE Vulnerability

CVE-2024-6469 Overview

CVE-2024-6469 affects playSMS 1.4.3, an open-source SMS management platform. The vulnerability resides in the Template Handler component, specifically in the firewall list feature accessed through /index.php?app=main&inc=feature_firewall&op=firewall_list. Attackers can manipulate the IP address argument using the input {{id} to trigger an injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The flaw is remotely exploitable and requires high privileges. The exploit details were publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can inject template expressions into the playSMS firewall list, enabling server-side template injection against the application's Template Handler.

Affected Products

playSMS 1.4.3

Discovery Timeline

2024-07-03 - CVE-2024-6469 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6469

Vulnerability Analysis

The vulnerability exists in the playSMS firewall management interface. The firewall_list operation accepts an IP address parameter that is passed to the application's Template Handler without proper neutralization. An authenticated attacker can supply a template expression such as {{id} in place of an IP address, causing the Template Handler to evaluate the injected expression.

Because the injection occurs inside a server-side template context, the flaw is categorized under [CWE-74]. Successful exploitation depends on how the Template Handler processes the injected payload and what functions it exposes. The disclosed proof-of-concept uses backtick execution semantics, suggesting command evaluation within the template engine.

The attack surface requires network access to the playSMS web interface and a valid authenticated session with elevated privileges. Public disclosure of the exploit increases the likelihood of opportunistic scanning against exposed playSMS 1.4.3 instances.

Root Cause

The root cause is improper neutralization of user-supplied input passed to the Template Handler. The IP address field in the firewall_list view does not validate that the input conforms to an IP address format before rendering. The Template Handler evaluates embedded expressions in the input, allowing injected template syntax to execute in the server context.

Attack Vector

Exploitation requires an authenticated session against the playSMS web application. The attacker submits a crafted value in the IP address field of the firewall list, using template syntax such as {{id} as the payload. The Template Handler then processes the input during list rendering, evaluating the injected expression. See the VulDB entry for VDB-270277 for the disclosed technical details.

Detection Methods for CVE-2024-6469

Indicators of Compromise

HTTP requests to /index.php?app=main&inc=feature_firewall&op=firewall_list containing template metacharacters such as {{, }}, or backticks in the IP address parameter.
Non-IP-formatted values written to the playSMS firewall configuration store.
Unexpected child processes spawned by the playSMS web server user during firewall list rendering.

Detection Strategies

Inspect web server access logs for requests to the feature_firewall endpoint with payloads that do not match a valid IPv4 or IPv6 pattern.
Deploy web application firewall rules that reject template delimiters and shell metacharacters in fields expected to contain IP addresses.
Correlate playSMS request logs with process execution telemetry to identify command evaluation triggered by template injection.

Monitoring Recommendations

Monitor authenticated administrative sessions accessing firewall configuration features in playSMS.
Track file integrity on playSMS installation directories to detect unauthorized changes following exploitation attempts.
Alert on outbound network connections initiated by the playSMS runtime that deviate from established baselines.

How to Mitigate CVE-2024-6469

Immediate Actions Required

Restrict network access to the playSMS administrative interface using firewall rules or VPN gating.
Enforce input validation at a reverse proxy for the IP address parameter on the feature_firewall endpoint.
Rotate administrative credentials and audit account activity for any signs of misuse of the firewall list feature.

Patch Information

No vendor patch is available. The VulDB advisory notes that the vendor was contacted about this disclosure but did not respond. Operators of playSMS 1.4.3 should assume the vulnerability remains unpatched and apply compensating controls.

Workarounds

Block requests to /index.php?app=main&inc=feature_firewall&op=firewall_list that contain template delimiters ({{, }}) or backtick characters.
Add server-side validation that rejects any value in the IP address field not matching a strict IPv4 or IPv6 regular expression.
Limit access to the firewall configuration feature to a minimal set of trusted administrators and audit their activity.

bash

# Example nginx rule to block template metacharacters on the vulnerable endpoint
location ~ ^/index\.php {
    if ($arg_op = "firewall_list") {
        if ($args ~* "(\{\{|\}\}|%60|`)") {
            return 403;
        }
    }
}