Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in ChurchCRM allows for remote code execution through an incomplete fix for a previous issue. If exploited, an attacker could gain full control of the application.
- Affects ChurchCRM software.
- Exploitable without authentication.
- Can lead to full system compromise.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability in ChurchCRM versions prior to 7.3.2 by sending a specially crafted request to the setup wizard. This allows them to execute arbitrary code on the server, potentially leading to a full compromise of the application and its underlying infrastructure. The flaw lies in an incomplete fix for a previous vulnerability related to unsanitized password input during the initial setup.
- Unauthenticated access required.
- Targets setup wizard.
- Pre-authentication RCE possible.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability, a pre-authentication RCE in ChurchCRM's setup wizard, is unlikely to be widely weaponized because the setup wizard should ideally be inaccessible after initial installation. Attackers generally prefer vulnerabilities in components that are persistently exposed and utilized.
- Setup wizard is typically temporary.
- Exploit requires direct access to setup.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize the ChurchCRM setup wizard for immediate review and mitigation, as pre-authentication RCE remains exploitable. Teams should focus on disabling or restricting access to this setup wizard and verifying its removal from accessible network interfaces.
- Restrict access to setup wizard.
- Monitor for unauthorized setup wizard access.
- Upgrade to version 7.3.2 when possible.
