CVE-2024-58136
CVE-2024-58136: Vulnerability in Yii 2 framework leading to potential remote code execution. This critical flaw, a regression from CVE-2024-4990, involves mishandling behavior attachment defined by the '__class' array key. Actively exploited in the wild between February and April 2025, this presents a significant security risk. With a SOCRadar Vulnerability Risk Score (SVRS) of 78, immediate patching is strongly recommended to mitigate potential exploits. The vulnerability falls under CWE-424, which relates to improper access control. This CVE poses a serious threat to applications using the affected versions of the Yii 2 framework, potentially allowing attackers to execute arbitrary code on vulnerable systems.
Description
CVE-2024-58136 describes a vulnerability in Yii 2, specifically in versions prior to 2.0.52. It involves the improper handling of behavior attachment defined by the '__class' array key, representing a regression of CVE-2024-4990. This vulnerability has been actively exploited by hackers in the wild between February and April 2025. While the CVSS score is 9, indicating high severity, the SOCRadar Vulnerability Risk Score (SVRS) is 78, placing it near the critical threshold, highlighting the urgency.
Key Insights
- Active Exploitation: The CVE is actively exploited by hackers in the wild, signifying immediate risk to systems running vulnerable versions of Yii 2.
- Regression Vulnerability: CVE-2024-58136 is a regression of CVE-2024-4990, indicating a reintroduction of a previously addressed vulnerability. This makes systems that previously patched CVE-2024-4990 vulnerable again.
- Behavior Attachment Issue: The core issue lies in the mishandling of behavior attachments defined via the '__class' array key, which allows attackers to potentially inject malicious code through this flawed mechanism.
Mitigation Strategies
- Immediate Upgrade: Upgrade Yii 2 to version 2.0.52 or later. This version contains the fix that addresses the vulnerability, preventing further exploitation.
- Code Review: Conduct a thorough code review of all Yii 2 applications to identify and remove any instances of vulnerable '__class' behavior attachments.
- Web Application Firewall (WAF) Rules: Implement or update WAF rules to detect and block malicious requests targeting the vulnerable '__class' behavior attachment mechanism. This can provide an additional layer of protection while upgrading and patching efforts are underway.
Additional Information
Given the active exploitation of this CVE in the wild, immediate action is critical to prevent potential security breaches. If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.