CVE-2024-24956

Executive Summary

CVE-2024-24956 is a critical heap-based out-of-bounds write vulnerability affecting the AutomationDirect P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw resides in the Programming Software Connection FileSystem API, specifically at firmware offset 0xb6a38, where an arbitrary null-byte write can be triggered by specially crafted network packets. This allows an unauthenticated attacker to corrupt heap memory, potentially leading to denial of service (DoS) or arbitrary code execution within the PLC runtime. With a CVSS score of 8.2 (High), the vulnerability is remotely exploitable over the network without authentication, posing a significant risk to industrial control system (ICS) environments. No public proof-of-concept (PoC) exploit or patch is currently available, making proactive detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No human involvement.
• Scope: Unchanged (S:U) – Vulnerability does not cross trust boundaries.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: High (A:H) – Likely causes PLC crash or DoS.

Threat Level: High. The vulnerability is remotely exploitable with low complexity, and the lack of a patch increases the risk of targeted attacks against ICS networks.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write in the FileSystem API of the AutomationDirect P3-550E PLC firmware. The API processes network packets to handle file system operations (e.g., read/write configuration files). At firmware offset 0xb6a38, the code fails to validate the length of user-supplied data before writing a null byte (0x00) to a heap buffer. This arbitrary null-byte write can corrupt adjacent heap metadata or other data structures, leading to heap corruption.

Technical Details:

• Root Cause: Missing bounds check on input length in the FileSystem API handler.
• Trigger: Sending a specially crafted network packet with a specific offset and payload that causes the null-byte write at an attacker-controlled location.
• Impact: Heap corruption can cause immediate denial of service (PLC crash) or, with careful heap grooming, potentially lead to arbitrary code execution. However, the null-byte write limits exploitation to corruption rather than full control.
• Attack Vector: The PLC listens on TCP port 80 (HTTP) or a proprietary protocol port (e.g., 44818 for Ethernet/IP). The attacker sends a malicious packet to the FileSystem API endpoint.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in firmware version 1.2.10.9. The patched version would require a firmware update from AutomationDirect. The vulnerable code snippet (reverse-engineered) would look like:

// Vulnerable code at offset 0xb6a38
void handle_file_write(uint8_t *buffer, uint32_t length) {
    char *heap_buf = malloc(256);
    // Missing bounds check: writes null byte at buffer[length] without verifying length < 256
    heap_buf[length] = '\0';  // Out-of-bounds write if length >= 256
    memcpy(heap_buf, buffer, length);
}

A patched version would include a bounds check:

void handle_file_write(uint8_t *buffer, uint32_t length) {
    if (length >= 256) {
        // Reject oversized request
        return;
    }
    char *heap_buf = malloc(256);
    heap_buf[length] = '\0';
    memcpy(heap_buf, buffer, length);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain an AutomationDirect P3-550E PLC with firmware 1.2.10.9.
2. Connect the PLC to an isolated network with a Kali Linux attacker machine.
3. Identify the PLC IP address (e.g., 192.168.1.100) and open port (e.g., 80 or 44818).

Exploitation Steps:

1. Craft a malicious packet targeting the FileSystem API. The packet must include a payload length that triggers the null-byte write at an offset beyond the heap buffer.
2. Use a tool like Scapy or a custom Python script to send the packet.
3. Monitor the PLC for crash or unexpected behavior.

Example Python exploit script (conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 80  # or 44818

# Craft packet: [header][payload_length][payload]
# The vulnerability triggers when payload_length >= 256
payload = b"A" * 300  # Exceeds buffer size
packet = b"\x00\x01" + len(payload).to_bytes(2, 'little') + payload

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(packet)
sock.close()

Note: No public exploit code is available; this is a conceptual example.

Blue Team

Detection:

• Monitor network traffic for anomalous packets to the PLC on ports 80 or 44818.
• Look for packets with unusually large payload lengths (e.g., >256 bytes) targeting the FileSystem API.
• Use intrusion detection systems (IDS) to alert on out-of-bounds write patterns.

Mitigation:

• Isolate the PLC on a segmented ICS network with strict firewall rules.
• Disable unnecessary services (e.g., HTTP if not required).
• Monitor PLC logs for crashes or unexpected restarts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TCP packets to port 80 or 44818 with payload length >256 bytes.
  • Packets containing repeated 'A' characters (0x41) or other padding patterns.
  • Unusual HTTP POST requests to /filesystem or similar endpoints.
• Host IOCs:
  • PLC crash logs indicating heap corruption.
  • Unexpected PLC reboots or watchdog timer resets.
  • Firmware memory dumps showing null bytes at arbitrary locations.

Detection Engineering

YARA Rule

rule CVE_2024_24956_Heap_Corruption {
    meta:
        description = "Detects network packets targeting AutomationDirect P3-550E FileSystem API with oversized payload"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24956"
    strings:
        $header = { 00 01 }  // Example packet header
        $payload_long = /.{256,}/  // Payload length >= 256 bytes
    condition:
        $header at 0 and #payload_long > 0
}

Sigma Rule

title: CVE-2024-24956 Exploitation Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6d-2e3f1a0b9c8d
status: experimental
description: Detects network packets with oversized payloads targeting AutomationDirect P3-550E FileSystem API
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port:
            - 80
            - 44818
        payload_length: >= 256
    condition: selection
falsepositives:
    - Legitimate large file transfers (unlikely on ICS networks)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 80,44818 (msg:"CVE-2024-24956 - AutomationDirect P3-550E Heap Corruption Attempt"; flow:to_server,established; content:"|00 01|"; depth:2; byte_test:2,>,256,2,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the PLC: Place the P3-550E on a dedicated VLAN with strict access controls. Disable remote access if not required.
2. Monitor for Exploitation: Deploy the provided Suricata/Sigma rules to detect malicious packets.
3. Apply Workarounds: If the FileSystem API is not needed, block the relevant ports (80, 44818) at the firewall.

Long-Term Fix:

• Contact AutomationDirect for a firmware patch. As of this report, no patch is available. Monitor the vendor's security advisory page for updates.
• Consider replacing the device with a patched alternative if the vulnerability cannot be mitigated.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert