CVE-2024-57764
Published: 15 January 2025
Summary
CVE-2024-57764 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and remediation of flaws like this FastJSON deserialization vulnerability through vendor patching to MSFM 2025.01.01 or later.
Mandates validation of syntax, content, and data types for inputs to the system/table/add endpoint to block malicious deserialization payloads.
Enforces approved authorizations to block unauthenticated remote access to the vulnerable deserialization component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The fastjson deserialization vulnerability in the /admin/system/table/add endpoint allows authenticated remote code execution through crafted JSON payloads using Java deserialization gadgets like JdbcRowSetImpl with RMI callbacks.
NVD Description
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.
Deeper analysisAI
MSFM versions prior to 2025.01.01 contain a deserialization vulnerability in the FastJSON library, accessible via the system/table/add component. Tracked as CVE-2024-57764 and published on 2025-01-15, this flaw is classified under CWE-502 (Deserialization of Untrusted Data) with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high confidentiality and integrity impacts.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation involves sending crafted requests to the affected endpoint, enabling severe consequences such as unauthorized access to sensitive data or modification of system state, consistent with the high confidentiality and integrity impact metrics.
The advisory referenced at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVCZ details the issue, with mitigation achieved by upgrading to MSFM version 2025.01.01 or later, which addresses the deserialization flaw in the FastJSON component.
Details
- CWE(s)