SPIP Remote Code Execution via Unserialization in Job Queue

Executive Summary

SPIP before 4.4.18 has a remote code execution vulnerability in the editer_objet action. The arg parameter allows SQL table name resolution without checking if columns are editable. Attackers with a valid nonce can inject rows into the spip_jobs table by setting arg=job/0 and providing malicious fonction and args values. These values are unserialized and executed when the cron job queue runs, leading to arbitrary PHP code execution on the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the affected system with the privileges of the SPIP application. This could lead to complete system compromise, data theft, unauthorized access, or further network infiltration. Any system running a vulnerable SPIP version is at risk if exposed to an attacker with a valid nonce.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. Immediate patching is critical to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SPIP to version 4.4.18 or later to patch the vulnerability. If updating is not immediately possible, restrict access to the editer_objet action and validate all inputs to prevent SQL table name resolution without an allowlist.

Useful 0 Not Useful 0