ThinkPHP 5 invokefunction RCE

aka ThinkPHP 5.0.23/5.1.31 RCE

Product: ThinkPHP (top-think) ThinkPHP 5.x
CVE: CVE-2018-20062 CVE-2019-9082
Disclosed: 2018-12-09
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 5.0.0 - 5.0.22, 5.1.0 - 5.1.30
Fixed: 5.0.23, 5.1.31

Summary

ThinkPHP 5 did not validate controller names taken from the 's' routing parameter, so a request can call any class method, including \think\app::invokefunction with call_user_func_array. It became one of the most-scanned web exploits on the internet, used by Mirai variants and miners.

Root cause

Without forced routing (the default), the framework parsed '/module/\namespace\class/method' from the URL and instantiated the class via the loader without checking it was a controller. Calling think\app's invokefunction with function=call_user_func_array and vars[] executes arbitrary PHP functions.

Impact

Unauthenticated RCE on ThinkPHP 5 apps (CMSs and admin panels built on it).

Public PoC

http://target:8080/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1

Source: vulhub / thinkphp/5-rce

Detection

Search logs for 'invokefunction', '\think\app' or 'call_user_func_array' in the 's=' parameter. nuclei template CVE-2018-20062.

Mitigation

Upgrade to 5.0.23 / 5.1.31+ and enable forced routing (url_route_must).