CVE-2018-20062

What is ThinkPHP?

ThinkPHP is an open-source PHP web application framework that is extremely popular among Chinese-language web developers and hosting providers, powering a large volume of small business sites, CMS platforms, and custom web applications across mainland China and other Chinese-speaking regions. Its ubiquity in that ecosystem — combined with the tendency of many small deployments to run outdated, unpatched versions — has made ThinkPHP one of the most consistently and heavily exploited web frameworks in mass-scanning and botnet campaigns since 2018.

Overview

CVE-2018-20062 describes a remote code execution vulnerability tied to how certain ThinkPHP-based deployments (referenced here as "noneCms," a ThinkPHP-based application) handle a request parameter internally referred to as filter. By crafting requests that abuse this parameter, an unauthenticated remote attacker can get the framework to invoke PHP functions of their choosing — commonly call_user_func or similar dynamic-call constructs — with attacker-controlled arguments, resulting in full remote code execution on the underlying server with no authentication required.

Technical Details

The underlying issue is a lack of input filtering around dynamic function invocation. ThinkPHP's routing/dispatch logic processes the filter parameter (and related parameters in some variants of this bug class) by passing its value into PHP's dynamic function-call mechanisms without restricting which functions can be called or validating the parameters passed to them. A crafted HTTP request can therefore instruct the server to execute arbitrary PHP code — for example spawning a system shell command — entirely pre-authentication and with a single HTTP request, which is what makes this bug so attractive for mass, automated exploitation.

Discovery

This vulnerability belongs to a well-documented family of ThinkPHP RCE bugs (closely related to earlier 2018/2019 ThinkPHP RCE disclosures) that circulated widely in Chinese-language security research and exploit-sharing communities shortly after disclosure. No specific individual researcher is confidently credited for this particular CVE entry.

Exploitation Context

CVE-2018-20062 has been mass-exploited essentially continuously since shortly after its disclosure. Automated scanning tools and IoT/Linux botnets — including Mirai-derived families observed scanning for vulnerable ThinkPHP instances — have used this and related ThinkPHP RCE bugs to compromise internet-facing servers en masse, typically to deploy cryptomining malware, add hosts to DDoS botnets, or establish footholds for further exploitation. Its inclusion in CISA's KEV catalog in November 2021 reflects that this remains an actively targeted, low-effort, high-yield vulnerability for opportunistic attackers years after disclosure.

Remediation

1. Upgrade ThinkPHP and any dependent applications (including noneCms-based deployments) to a patched, currently supported release — legacy ThinkPHP 5.x branches in particular should be fully updated or replaced.
2. Audit internet-facing servers for signs of prior compromise, including unexpected cron jobs, unfamiliar processes, or outbound connections consistent with cryptomining or botnet C2 traffic.
3. Deploy a web application firewall (WAF) with rules targeting known ThinkPHP RCE exploitation patterns as a compensating control while patching is completed.
4. Restrict outbound internet access from web servers where feasible, to limit the value of RCE for payload download and C2 communication.
5. Monitor web server access logs for the characteristic crafted request patterns associated with ThinkPHP filter/dynamic-function-call exploitation attempts.