Is CVE-2017-5543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5543 being exploited in the wild.

How severe is CVE-2017-5543?

Critical severity, with a CVSS score of 9.8, published 20 January 2017.

Which products and versions are affected?

Intelliants Subrion CMS 4.0.5; intelliants/subrion (Packagist) ECOSYSTEM:introduced=4.0.5,fixed=4.1.0.

Is there a fix for CVE-2017-5543?

Yes. intelliants/subrion (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5543 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5543?

Check whether you run Intelliants Subrion, Intelliants Subrion CMS or intelliants/subrion (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5543: Intelliants Subrion CMS PHP Object Injection in ia.core.users.php

CVE-2017-5543 · Severity: critical · CVSS 9.8 · Published 2017-01-20

Subrion CMS, a content management system used for building websites, contains a critical security flaw in its login process. An attacker can send a specially crafted web request that tricks the system into executing unauthorized code. This could allow a remote attacker to take full control of the website, access sensitive user data, or disrupt operations without needing a password.

Technologies: Intelliants Subrion CMS, intelliants/subrion (Packagist). Vendors: Intelliants, Packagist.

Quick answers

Is CVE-2017-5543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5543 being exploited in the wild.
How severe is CVE-2017-5543?: Critical severity, with a CVSS score of 9.8, published 20 January 2017.
Which products and versions are affected?: Intelliants Subrion CMS 4.0.5; intelliants/subrion (Packagist) ECOSYSTEM:introduced=4.0.5,fixed=4.1.0.
Is there a fix for CVE-2017-5543?: Yes. intelliants/subrion (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5543 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5543?: Check whether you run Intelliants Subrion, Intelliants Subrion CMS or intelliants/subrion (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

intelliants/subrion (Packagist): upgrade to 4.1.0 or later
```
composer require intelliants/subrion:^4.1.0
```

Technical details

A PHP Object Injection vulnerability exists in Subrion CMS 4.0.5 within the `includes/classes/ia.core.users.php` file. The application improperly handles user-supplied data by passing the 'salt' cookie directly into the `unserialize()` function during a login request. A remote, unauthenticated attacker can exploit this by providing a crafted serialized object in the cookie. This triggers PHP magic methods such as `__wakeup()` or `__destruct()`, which can be leveraged to achieve arbitrary code execution or unauthorized file manipulation. The issue was addressed in version 4.1.0.

Affected products

Intelliants Subrion CMS 4.0.5

Identifiers

CVE-2017-5543
GHSA-4j79-4m6q-77vf

Timeline

2017-01-17: disclosed: Issue reported on GitHub
2017-01-20: advisory: NVD published CVE-2017-5543

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.