Is PeopleSync Affected by CVE-2024-1874?

🤔 Problem

PeopleSync Frontend releases < 23.8.3 are using PHP versions which are vulnerable to CVE-2024-1874.

This regards command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows.

🌱 Solution

Please upgrade to PeopleSync version 23.8.61.47932 with frontend version 23.8.3.

If you are already on PeopleSync version 23.8, it is sufficient to only upgrade the frontend to version 23.8.3.

If you are unable to upgrade to PeopleSync 23.8 and/or frontend version 23.8.3, you can implement the following mitigation:

1. Log in to the PeopleSync frontend server.

2. Open Notepad with elevated rights.

3. Open C:\Program Files\messageconcept\PeopleSync Server\PHP\php.ini

4. Add the following line at the bottom of the file:
   disable_functions = proc_open

5. Save the file.

6. Open a command window (cmd.exe) with elevated rights.

7. Restart IIS by running the following command:
   iisreset

📎 Related articles