Vulnerability · Published Aug 23, 2024 · Assigned by VulnCheck

CVE-2024-7954SPIP porte_plume Plugin Arbitrary PHP Execution

Critical 9.8

In plain English

A critical-severity security flaw in SPIP from SPIP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 90.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)90.1%top 0.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	spip	4.3.0+dfsg-1	DEBIAN-CVE-2024-7954
Debian:14	spip	4.3.0+dfsg-1	DEBIAN-CVE-2024-7954
Ubuntu:22.04:LTS	spip	no fix listed	UBUNTU-CVE-2024-7954
Ubuntu:24.04:LTS	spip	no fix listed	UBUNTU-CVE-2024-7954

Affected products (as reported)

Vendor	Product	Versions
SPIP	SPIP	4.3.0-alpha – before 4.3.0-alpha24.2.0 – before 4.2.134.1.0 – before 4.1.16

Weakness: CWE-95, CWE-1286 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://vulncheck.com/advisories/spip-porte-plume third-party-advisory
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html vendor-advisory
https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/ technical-description, exploit