CVE-2024-2054
CRITICALArtica-Proxy - Unauthenticated Remote Code Execution via PHP Deserialization
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-2054.
PoCs published by Madan, Madan301, including Metasploit module exploits/linux/http/artica_proxy_unauth_rce_cve_2024_2054.
AI-analyzed exploit summary This exploit targets a deserialization vulnerability in Artica Proxy 4.40/4.50, allowing remote code execution via a crafted payload. It writes a PHP shell to a writable directory and executes arbitrary commands through HTTP GET requests.
Description
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
Exploits (3)
This exploit targets a deserialization vulnerability in Artica Proxy 4.40/4.50, allowing remote code execution via a crafted payload. It writes a PHP shell to a writable directory and executes arbitrary commands through HTTP GET requests.
This repository contains a functional exploit for CVE-2024-2054, an insecure deserialization vulnerability in Artica Proxy's administrative web application. The exploit leverages a base64-encoded PHP payload to achieve remote code execution (RCE) by manipulating the `wiz.upload.php` endpoint.
This Metasploit module exploits an unauthenticated PHP deserialization vulnerability in Artica Proxy versions 4.40 to 4.50, allowing remote code execution as the 'www-data' user via crafted HTTP requests.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H