cve/2024/CVE-2024-2054.md

### [CVE-2024-2054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2054)
![](https://img.shields.io/static/v1?label=Product&message=Artica%20Proxy&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%204.50%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%20Deserialization%20of%20Untrusted%20Data&color=brighgreen)

### Description

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2024/Mar/12
- https://korelogic.com/Resources/Advisories/KL-001-2024-002.txt

#### Github
- https://github.com/Madan301/CVE-2024-2054
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/tanjiti/sec_profile