External risk intelligence

WuKongCRM Remote Code Execution via Fastjson ParseObject Function.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-23052

WukongCRM is a Customer Relationship Management (CRM) application. CRM systems are typically deployed as web applications intended to be accessed by users over a network, and they are frequently hosted as internet-facing web portals to facilitate remote business operations and external access.

Deserialization

5kcrm Wukong Crm

9.0.1_20191202

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in a Customer Relationship Management (CRM) system that could allow remote attackers to execute arbitrary code. The issue lies within a component used for data processing. While the full business impact depends on the specific deployment and usage of this CRM system, such vulnerabilities can pose significant risks if exploited. The main concern is confirming the relevance and exposure of this CRM system within your organization.

Remote code execution in CRM software.
Critical flaw impacts system integrity and data.
Verify CRM system relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a vulnerable WukongCRM instance. This request would target the fastjson component, specifically its `parseObject()` function. Successful exploitation would allow the attacker to execute arbitrary code on the affected system, leading to a complete compromise.

No authentication or user interaction needed.
Remote network request targets `parseObject()` function.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code by exploiting a deserialization vulnerability in the fastjson component. This could impact system data and service behavior when the application is accessible over a network.

System data could be compromised.
Code execution via network requests.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding ownership and the initial response to this critical vulnerability requires identifying the team accountable for the WukongCRM application, likely an application or platform team, in coordination with security and network teams. The immediate priority is to determine the application's reachability and business criticality to inform a risk-based remediation plan, potentially involving vendor engagement or temporary risk reduction measures.

Application owners should manage the issue.
Verify external accessibility and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WukongCRM?

WukongCRM is a Customer Relationship Management (CRM) application used by businesses to manage client data and interactions. It functions as a web-based portal, often hosted to support remote business operations, which allows employees or clients to access information over a network.

What does CWE-502 mean for CVE-2024-23052?

CWE-502 refers to Deserialization of Untrusted Data. In the context of this vulnerability, it means the application processes incoming data without sufficient validation. Because the fastjson component improperly handles this input, an attacker can manipulate the process to execute their own code on the underlying server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the application. This request targets the parseObject() function within the fastjson component. The vulnerability does not require authentication or user interaction; if the application receives the malicious request, the code execution can occur automatically.

Is my WukongCRM instance at risk?

Your risk depends on your deployment. Halo Surface Signal notes that WukongCRM is frequently hosted as an internet-facing web portal for remote access. If your installation is accessible via the public internet, it has a higher potential for being targeted by remote attackers compared to systems restricted to an internal-only network.

What steps should I take if I run WukongCRM?

First, identify the team responsible for managing your WukongCRM deployment. Verify if your instance is reachable from the network and assess its business criticality. Use this information to coordinate with security teams to prioritize a remediation plan, such as applying patches or implementing temporary network access controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.