Cyber Posture

CVE-2024-57766

CriticalPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0030 53.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2024-57766 is a deserialization vulnerability in the FastJSON library within MSFM versions prior to 2025.01.01. The flaw resides in the system/table/editField component and is classified as CWE-502 (Deserialization of Untrusted Data). It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), marking it as critical due to its potential for severe impact.

The vulnerability can be exploited by unauthenticated remote attackers requiring low complexity and no user interaction. Exploitation enables high confidentiality and integrity impacts, allowing attackers to access sensitive data and modify system information without affecting availability.

The advisory reference at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVHR details the issue, with mitigation provided in MSFM version 2025.01.01 and later. Security practitioners should upgrade to the patched version promptly.

Details

CWE(s)
CWE-502

Affected Products

wangl1989
mysiteforme
≤ 2025-01-01

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

FastJSON deserialization vulnerability via /admin/system/table/editField enables remote code execution with crafted JSON payloads (e.g., JdbcRowSetImpl gadget), facilitating exploitation of public-facing web applications (T1190), remote services (T1210), and privilege escalation (T1068) post-authentication.

References