External risk intelligence

ThinkPHP Deserialization Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-44902

ThinkPHP is a widely used web application framework designed for developing public-facing websites and web applications. As a core component of web services, it is commonly deployed in internet-facing configurations to handle HTTP requests, making the attack surface readily accessible from the public internet in standard deployment patterns.

Deserialization

Thinkphp

6.1.3 to 8.0.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability identified in ThinkPHP, a web application framework. The flaw, stemming from a deserialization issue, could allow unauthorized code execution if exploited. The primary concern is confirming if ThinkPHP, within the specified versions, is deployed within the organization's environment and if so, to what extent it is exposed.

Code execution flaw in web framework.
Critical rating; confirm relevance and exposure.
Understand and address potential framework risks.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a web application using a vulnerable version of ThinkPHP. This request triggers a deserialization flaw, allowing the attacker to execute arbitrary code on the server.

No user interaction needed.
Triggered by network request.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A deserialization vulnerability in ThinkPHP frameworks, when running versions 6.1.3 through 8.0.4, could allow an attacker to execute arbitrary code. This could affect the integrity and availability of the application and its underlying system, depending on the application's configuration and the attacker's success.

Arbitrary code execution on the server.
Exploiting network-accessible endpoints.
Compromise of application and server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this deserialization vulnerability lies with application owners and platform teams managing ThinkPHP deployments. The immediate priority is to conduct an inventory of all ThinkPHP instances, assess their exposure and criticality, and identify the specific accountable teams or individuals. Remediation planning should then be risk-based, considering factors like business impact and available maintenance windows.

Application owners must prioritize this issue.
Verify all ThinkPHP instances and their reachability.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ThinkPHP?

ThinkPHP is a popular open-source web application framework written in PHP. It provides a structured foundation for developers to build public-facing websites and dynamic web services more efficiently. By handling common tasks like routing, database interactions, and request management, it serves as a core engine for many web applications.

How does CVE-2024-44902 work?

This vulnerability is classified as CWE-502, or Deserialization of Untrusted Data. In simple terms, the framework improperly handles data provided by users when it attempts to turn that data back into usable objects. By sending a specially crafted request, an attacker can manipulate this process to force the server to execute unintended, unauthorized commands.

How is this ThinkPHP vulnerability triggered?

An attacker triggers the flaw by sending a malicious request to an application running a vulnerable version of ThinkPHP. The vulnerability relies on the framework processing this crafted input. It is important to note that this does not require a legitimate user to click a link or perform any action; the flaw is triggered directly by the incoming network request handled by the server.

Is my application at risk?

According to Halo Surface Signal, ThinkPHP is frequently deployed in internet-facing configurations to handle public web traffic. Because this framework is often used for public-facing websites, these deployments are typically accessible from the internet, increasing the likelihood that they could be reached by an attacker. You should evaluate any server running versions 6.1.3 through 8.0.4 to determine if it is reachable from the public internet.

What should I do if I use ThinkPHP?

First, conduct an inventory to identify every instance of ThinkPHP within your environment. Once you have a list of deployments, confirm which ones fall into the affected version range of 6.1.3 to 8.0.4. Assess the criticality of each instance and its connectivity to the network. Use this information to prioritize your remediation efforts, focusing on the most exposed or business-critical systems first.

References

github.com/fru1ts/CVE-2024-44902

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.