CVE-2024-28125

Executive Summary

CVE-2024-28125 is a disputed vulnerability in FitNesse, a web-based collaborative tool for software testing. The vulnerability allows a remote authenticated attacker to execute arbitrary OS commands. The vendor (FitNesse) claims this is a product specification, not a vulnerability, and the issue is under further investigation. No official patch is available, and no public proof-of-concept (PoC) or exploit code has been released. The CVSS score is 0.0, and the EPSS score is 0.0%, indicating low exploitation activity.

Supply Chain & Package Security

FitNesse is a Java-based tool distributed as a JAR file. There is no NPM, PyPI, Go, or Ruby package involved. The risk is limited to direct deployments of FitNesse.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored due to dispute)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Medium (due to authentication requirement and dispute)

Deep Dive & Mechanics

FitNesse is a wiki-based testing framework. The vulnerability lies in the ability of an authenticated user to execute arbitrary OS commands through the tool's interface. The exact mechanism is not publicly documented, but it likely involves the use of special characters or command injection in fields that are passed to the OS shell. The vendor's claim that this is a "product specification" suggests that the ability to run commands is intentional, but the lack of proper input validation or sandboxing makes it exploitable.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is the entire FitNesse codebase, as the feature allowing command execution is built-in. Without a patch, the only mitigation is to restrict access to the FitNesse interface.

Exploitation & Lab Setup

Red Team

Since no public exploit exists, a red team would need to craft a custom exploit. The attack requires authentication. Steps:

1. Setup: Deploy FitNesse in a lab environment (e.g., using Docker).
2. Authenticate: Obtain valid credentials (e.g., default admin/admin).
3. Identify Injection Point: Explore the wiki interface for fields that execute commands (e.g., test runner, script execution).
4. Craft Payload: Inject OS commands (e.g., ; ls -la or | whoami).
5. Execute: Send the payload and observe the output.

Example payload (conceptual):

# In a FitNesse test page, add a command like:
!define COMMAND {ls -la}
!execute {${COMMAND}}

Blue Team

• Monitor Logs: Look for unusual command execution patterns in FitNesse logs.
• Restrict Access: Use network segmentation to limit access to FitNesse.
• Input Validation: Implement a reverse proxy to filter malicious input.
• User Training: Educate users about the risks of command execution.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from the FitNesse server.
• Logs: Entries containing shell commands (e.g., ls, whoami, id) in FitNesse logs.
• Process: Unexpected child processes spawned by the Java process running FitNesse.

Detection Engineering

YARA Rule

rule CVE_2024_28125_FitNesse_Command_Injection {
    meta:
        description = "Detects potential command injection in FitNesse logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28125"
    strings:
        $cmd1 = "!execute" nocase
        $cmd2 = "!define" nocase
        $cmd3 = "COMMAND" nocase
        $shell = /[;&|`$]/
    condition:
        all of ($cmd*) and #shell > 0
}

Sigma Rule

title: FitNesse Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to execute OS commands via FitNesse
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: FitNesse
detection:
    selection:
        EventID: 1000  # Example event ID for FitNesse logs
        Message|contains:
            - "!execute"
            - "!define"
            - "COMMAND"
    condition: selection
falsepositives:
    - Legitimate use of FitNesse command execution feature
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28125 FitNesse Command Injection Attempt"; flow:to_server,established; content:"!execute"; nocase; content:"!define"; nocase; content:"COMMAND"; nocase; pcre:"/[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to FitNesse to trusted users only.
• Short-term: Implement a reverse proxy with input validation to block command injection attempts.
• Long-term: Monitor for official patches or updates from FitNesse. Consider migrating to an alternative testing tool if the feature is not required.
• Compensating Controls: Use application-level firewalls and intrusion detection systems.

Valters IT