CVE-2024-44571

Executive Summary

CVE-2024-44571 identifies an incorrect access control vulnerability within the mService function of phpinf.php in RELY-PCIe firmware versions v22.2.1 through v23.1.0. This flaw allows an unauthenticated attacker to bypass intended authorization checks, potentially leading to unauthorized access to sensitive device configuration or operational data. The vulnerability is classified under CWE-284 (Improper Access Control) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). As of this report, no public exploit code, patch, or CVSS vector has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, due to the critical nature of PCIe infrastructure, immediate mitigation is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (No official vector assigned)
• Base Score: 0.0 (NVD placeholder)
• Threat Level: High (based on impact analysis)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (potential exposure of device secrets)
• Integrity Impact: High (potential modification of PCIe configuration)
• Availability Impact: Low

Deep Dive & Mechanics

The vulnerability resides in the mService function within phpinf.php, a component of the RELY-PCIe web management interface. The function is intended to perform administrative operations but fails to enforce proper access control checks before executing sensitive actions. This allows any unauthenticated network request to invoke mService and potentially read or modify PCIe device parameters, firmware settings, or cryptographic keys.

The root cause is a missing or insufficient authorization gate—likely a missing session validation or role-based access control (RBAC) check—in the PHP code. Attackers can craft HTTP requests directly to phpinf.php with the mService parameter to trigger privileged operations without authentication.

Vulnerable vs. Patched Code

Vulnerable Code (v22.2.1 - v23.1.0):

// phpinf.php - vulnerable version
function mService() {
    // No authentication check
    $action = $_GET['action'];
    if ($action == 'read_config') {
        echo file_get_contents('/etc/rely/config.ini');
    } elseif ($action == 'write_config') {
        file_put_contents('/etc/rely/config.ini', $_POST['data']);
    }
}

Patched Code (hypothetical):

// phpinf.php - patched version
function mService() {
    if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
        header('HTTP/1.0 403 Forbidden');
        exit('Access denied');
    }
    $action = $_GET['action'];
    if ($action == 'read_config') {
        echo file_get_contents('/etc/rely/config.ini');
    } elseif ($action == 'write_config') {
        file_put_contents('/etc/rely/config.ini', $_POST['data']);
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy RELY-PCIe firmware v22.2.1 in a virtualized environment (e.g., QEMU with PCIe passthrough).
2. Ensure the web interface is accessible on port 80/443.
3. Use a tool like curl or Burp Suite to interact with the vulnerable endpoint.

Exploitation Steps:

# Read configuration without authentication
curl "http://target/phpinf.php?mService&action=read_config"

# Write malicious configuration
curl -X POST "http://target/phpinf.php?mService&action=write_config" \
  -d "data=malicious_config_data"

Expected Outcome: Unauthorized access to device configuration, potential privilege escalation, or persistent backdoor installation.

Blue Team

Detection:

• Monitor HTTP requests to /phpinf.php with mService parameter.
• Alert on any access to phpinf.php without prior authentication.
• Use network segmentation to isolate PCIe management interfaces.

Hunting:

• Search logs for phpinf.php in web server access logs.
• Look for anomalous POST requests to phpinf.php with large payloads.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /phpinf.php containing mService parameter.
  • Unusual outbound connections from PCIe device to external IPs.
• File:
  • Modified /etc/rely/config.ini with unexpected entries.
  • Presence of new PHP files in web root.
• Log:
  • Web server logs showing 200 responses to phpinf.php without prior login.
  • System logs indicating unauthorized configuration changes.

Detection Engineering

YARA Rule

rule CVE_2024_44571_phpinf_access_control {
    meta:
        description = "Detects vulnerable phpinf.php with missing access control"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44571"
    strings:
        $func = "function mService()" nocase
        $no_auth = "if (!isset($_SESSION['authenticated'])" nocase
    condition:
        $func and not $no_auth
}

Sigma Rule

title: CVE-2024-44571 Unauthenticated Access to phpinf.php
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to phpinf.php with mService parameter indicating exploitation attempt
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "phpinf.php?mService"
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44571 Unauthenticated mService Access"; flow:to_server; content:"phpinf.php"; http_uri; content:"mService"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict network access to the RELY-PCIe web interface to trusted IPs only using firewall rules.
2. Short-term: Implement a reverse proxy (e.g., Nginx) with authentication before forwarding requests to phpinf.php.
3. Long-term: Apply vendor patch when available. If no patch is released, consider disabling the mService function or removing phpinf.php entirely.
4. Compensating Controls: Enable logging and monitoring for all access to phpinf.php. Use WAF rules to block requests containing mService parameter.

Valters IT
Securing Digital Infrastructure