CVE-2024-2053

Deeper analysis

The vulnerability CVE-2024-2053 affects the Artica Proxy administrative web application, specifically version 4.50. It stems from the application's deserialization of arbitrary PHP objects supplied by unauthenticated users, which leads to code execution as the www-data user. The component also attempts to block local file inclusion, but these controls can be bypassed to permit arbitrary file requests returned under www-data privileges. The issue carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, no required privileges or user interaction, and high confidentiality impact.

Unauthenticated remote attackers can supply malicious serialized objects or file paths directly to the administrative web interface. Successful exploitation grants the ability to execute code or read arbitrary files on the server with the privileges of the www-data account, enabling disclosure of sensitive configuration or data without authentication.

Public advisories published via KoreLogic and Seclists in March 2024 document the deserialization and path traversal flaws but do not detail available patches or configuration workarounds in the referenced materials.

The EPSS probability rose to a peak of 0.4086 before settling at the current value of 0.3654, indicating that exploitation interest increased after public disclosure.