Attack Chain

1. An attacker identifies a Perfex CRM instance exposed to the internet.
2. The attacker crafts a malicious PHP object designed to execute arbitrary code. This object could leverage existing classes within the Perfex CRM codebase, or potentially utilize PHP's built-in functions for code execution.
3. The malicious PHP object is serialized using PHP's serialize() function.
4. The serialized object is base64 encoded.
5. The base64 encoded string is set as the value of the autologin cookie in an HTTP request.
6. The attacker sends the crafted HTTP request to the Perfex CRM instance, targeting a page that processes the autologin cookie.
7. The Perfex CRM application receives the request and passes the value of the autologin cookie directly to the unserialize() function.
8. The unserialize() function reconstructs the malicious PHP object, triggering the execution of the attacker's arbitrary code. This can lead to complete system compromise, including data exfiltration, installation of malware, or defacement of the CRM system.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code on the server hosting Perfex CRM. This could lead to complete system compromise, including sensitive customer data exfiltration, installation of ransomware, or defacement of the CRM system. Organizations using vulnerable Perfex CRM instances are at high risk of data breaches, financial loss, and reputational damage.

Recommendation

• Inspect web server logs for requests with unusually long autologin cookie values to identify potential exploitation attempts (reference: web server logs).
• Deploy the provided Sigma rule to detect exploitation attempts based on the structure of the autologin cookie (reference: Sigma rule).
• Implement input validation on the autologin cookie to prevent the injection of serialized PHP objects (reference: vulnerability details).