Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in Rox, the software used by BeWelcome, could allow unauthorized users to execute arbitrary code on affected systems, potentially leading to a full site compromise. This issue arises from the software's handling of untrusted data during data deserialization processes, impacting user recovery functions and memory cookies.
- Allows unauthorized code execution.
- Could lead to full site compromise.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending specially crafted data to the BeWelcome web application. If the application processes a POST parameter named `formkit_memory_recovery` or reads a cookie named `bwRemember`, it might deserialize untrusted data. This deserialization process can lead to object injection, allowing an attacker to execute arbitrary code on the server or write files, ultimately compromising the entire site.
- Requires authenticated access or public exposure.
- Triggered by deserializing user-controlled input.
- Risk of arbitrary file write or RCE.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, unauthorized users could execute arbitrary code or write arbitrary files on the server by exploiting a PHP object injection vulnerability within Rox, the software running BeWelcome. This could lead to a complete compromise of the affected site.
- Arbitrary code execution and file writes.
- Exploiting deserialization of untrusted input.
- Full site compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in Rox, the software powering BeWelcome, requires a coordinated response. Application owners are responsible for identifying Rox instances, while infrastructure and security teams should confirm network exposure and business criticality. The first practical step is to locate all deployments, assess their reachability and importance, and then plan remediation, prioritizing critical and externally accessible systems.
- Identify Rox instances and assess exposure.
- Confirm ownership and business criticality.
- Plan remediation based on risk.
