CVE-2024-48112: ThinkPHP Deserialization Vulnerability Leading to Arbitrary Code Execution
Summary
CVE-2024-48112: ThinkPHP deserialization vulnerability. Affects topthink/thinkphp versions >= 6.1.3, <= 8.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ThinkPHP is a popular PHP framework designed for rapid application development. It provides a robust set of features for building web applications, including MVC architecture, ORM, and routing capabilities. However, versions 6.1.3 to 8.0.4 are vulnerable to a deserialization issue that can be exploited by attackers to execute arbitrary code, compromising the integrity and security of applications built on this framework.
Vulnerability Detail
A deserialization vulnerability exists in the component \controller\Index.php of ThinkPHP versions 6.1.3 to 8.0.4. This flaw allows attackers to manipulate serialized data, leading to the execution of arbitrary code on the server. The vulnerability arises from improper handling of user input during the deserialization process, which can be exploited to gain unauthorized access and control over the application. The potential ramifications include data breaches, unauthorized actions, and complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize any user input before it is processed. This can help mitigate the risk of deserialization attacks. However, updating to a secure version is the recommended solution.
Conclusion
The deserialization vulnerability in ThinkPHP versions 6.1.3 to 8.0.4 poses a significant risk to applications built on this framework. It is crucial for developers to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for topthink/thinkphp →
FAQ
Deserialization vulnerability occurs when an application improperly handles serialized data, allowing attackers to manipulate it and execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and full control over the affected application.
Yes, updating to a version higher than 8.0.4 of ThinkPHP will patch this vulnerability.
The CVSS score for this vulnerability is 9.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for topthink/thinkphp.
