dbugs — CVE Database, Vulnerability Trends & Research

PHP maintains various global states that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after a reset, causing it to refer to request memory after it has been freed. This use-after-free condition occurs when a fatal error interrupts an operation or cleanup phase before the state is reset, and the persistent worker is reused for a subsequent request. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request to the `session.upload progress` component, potentially leading to remote code execution (RCE). This issue specifically affects mod php, while FPM is conditionally affected through application-stage paths.

An unauthenticated remote code execution issue exists in React Server Components due to unsafe deserialization of payloads in HTTP requests sent to Server Function endpoints. The flaw is specifically linked to the `requireModule()` function and deficiencies in the deserialization mechanism when processing the `hasOwnProperty` parameter. This allows a remote attacker to execute arbitrary JavaScript code in the server context. Real-world exploitation has been observed globally across multiple industries, including retail, finance, and business services. Attackers have used this to deploy the EtherRAT backdoor, which utilizes blockchain-based command-and-control (C2) via Ethereum smart contracts, as well as the Weaxor ransomware and cryptocurrency miners. In some incidents, attackers deployed Cobalt Strike beacons and disabled Windows Defender within a minute of gaining initial access.

An issue exists that could potentially allow remote code execution on the server. This occurs under a rare combination of non-default session settings and specific application behavior. The issue is related to the session upload progress functionality.

A stack-based buffer overflow and out-of-bounds memory read exist in the affected software. This allows a remote unauthenticated attacker to achieve remote code execution and elevate privileges. Real-world exploitation has been observed since mid-December 2024, targeting financial institutions and government agencies. Attackers have utilized an ELF-based remote-access Trojan (RAT) known as DslogdRAT, which employs a configuration setup routine `init config()` to decrypt settings using an XOR cipher and a `child()` function to maintain persistence through continuous forking. The exploitation process involves disabling SELinux, preventing syslog forwarding, remounting the drive as read-write, deploying web shells, and manipulating the Ivanti Integrity Checker Tool (ICT) manifest to bypass integrity checks. Additionally, the PHASEJAM malware has been used to display fake update progress bars to deceive administrators while blocking legitimate system updates.