CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier
Attackers can achieve remote code execution by sending malicious serialized data in cookies to the TorrentPier web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40624?
CVE-2024-40624 is a critical unsafe deserialization vulnerability in torrentpier, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability.
Weakness: CWE-502
Which versions are affected by CVE-2024-40624?
2 open source packages ship an affected version, including torrentpier/torrentpier.
| Package | Affected | Fixed in |
|---|---|---|
torrentpier/torrentpier Packagist | All versions | 2.4.4 |
torrentpier/torrentpier Packagist | All versions | 2.4.4 |
How do I fix CVE-2024-40624?
Upgrade torrentpier/torrentpier to 2.4.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-40624 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40624 exists.
Sources
Also known as GHSA-fg86-4c2r-7wxw.