CVE-2024-6944
Published: 21 July 2024
Summary
CVE-2024-6944 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Crmeb Crmeb. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-6944 is a deserialization vulnerability in ZhongBangKeJi CRMEB versions up to 5.4.0, specifically in the get_image_base64 function within PublicController.php. The flaw arises from improper handling of the file argument, which permits deserialization of untrusted data and is tracked under CWE-502. It carries a CVSS 4.0 score of 5.3 and can be triggered remotely without authentication.
An authenticated remote attacker can supply a crafted file argument to trigger the deserialization flaw, potentially leading to arbitrary code execution or other impacts on the affected CRMEB instance. The exploit has already been published publicly via a gist and vulnerability databases, enabling straightforward reproduction by anyone with network access to the target.
The vendor was notified prior to disclosure but provided no response, and no official patches or mitigation guidance appear in the available references. The associated EPSS score has remained flat at 0.2493 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47930
Vulnerability details
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched…
more
remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote exploitation of deserialization and arbitrary file read vulnerability in public-facing PHP web application (T1190) enables collection of data from local system files (T1005).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.