CVE-2024-45261

Executive Summary

CVE-2024-45261 is a critical authentication bypass vulnerability affecting multiple GL.iNet router models (MT6000, MT3000, MT2500, AXT1800, AX1800) running firmware version 4.6.2. The core flaw lies in the Session ID (SID) generation mechanism, where the SID is not cryptographically bound to the specific user who generated it. This allows an authenticated attacker (or an attacker who has already bypassed initial authentication) to reuse or forge a valid SID belonging to another user, leading to privilege escalation and full device compromise.

The vulnerability is particularly dangerous because it targets the device's web management interface, which is often exposed to the local network or, in misconfigured cases, the internet. An attacker with network access can exploit this to gain administrative control, intercept traffic, modify DNS settings, or pivot to other internal systems.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires a valid session or initial access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – Compromise of the device can impact other systems.
• Confidentiality (C): High (H) – Full access to device data and network traffic.
• Integrity (I): High (H) – Full control to modify device configuration.
• Availability (A): High (H) – Can render device inoperable.

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical. The vulnerability allows for complete device takeover with low complexity.

Deep Dive & Mechanics

The vulnerability resides in the session management logic of the GL.iNet web interface (likely a custom Lua or Python-based backend). When a user authenticates, the server generates a Session ID (SID) and associates it with that user's session. The flaw is that the SID is generated using a predictable or non-user-specific seed (e.g., timestamp, device serial, or a static value). This means:

1. SID Reuse: An attacker who obtains a valid SID (e.g., by sniffing traffic or from a compromised low-privilege account) can use that same SID to impersonate another user, including an administrator.
2. SID Forging: If the SID generation algorithm is weak, an attacker can predict or brute-force valid SIDs for other users.
3. Privilege Escalation: A low-privilege user (e.g., guest) can obtain an admin's SID and gain full control.

The attack flow:

1. Attacker gains network access to the GL.iNet device (e.g., via Wi-Fi, LAN, or exposed web interface).
2. Attacker authenticates as a low-privilege user or intercepts a session token.
3. Attacker manipulates the SID (e.g., by modifying a cookie or API request) to match an admin's SID.
4. The server accepts the forged SID, granting admin privileges.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable (Conceptual):

# Vulnerable SID generation - not tied to user
import time
def generate_sid():
    return hashlib.md5(str(time.time()).encode()).hexdigest()  # Predictable

# Session storage - no user binding
sessions = {}
def create_session(user):
    sid = generate_sid()
    sessions[sid] = user  # SID is key, but user is not embedded in SID
    return sid

def authenticate(sid):
    return sessions.get(sid)  # Any valid SID works for any user

Patched (Conceptual):

# Patched SID generation - tied to user
import secrets
def generate_sid(user):
    return secrets.token_urlsafe(32) + ":" + user  # SID contains user identity

# Session storage - user is embedded
sessions = {}
def create_session(user):
    sid = generate_sid(user)
    sessions[sid] = user
    return sid

def authenticate(sid):
    # Extract user from SID and verify
    try:
        token, user = sid.rsplit(":", 1)
        if sessions.get(sid) == user:
            return user
    except:
        return None

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain a GL.iNet MT3000 or similar device.
2. Flash firmware version 4.6.2.
3. Connect to the device's LAN or Wi-Fi.
4. Identify the web interface IP (default: 192.168.8.1).

Exploitation Steps:

1. Intercept a valid SID: Use a proxy (Burp Suite) to capture a session cookie after logging in as a guest.
2. Analyze SID pattern: Look for patterns (e.g., timestamps, incremental values).
3. Forge an admin SID: If the pattern is predictable, generate an SID for the admin user. Alternatively, if the SID is not user-bound, simply reuse the captured SID to access admin endpoints.
4. Escalate privileges: Access /cgi-bin/api/admin/ endpoints to change admin password, modify firewall rules, or exfiltrate data.

Example cURL command (conceptual):

# Capture a guest SID
curl -c cookies.txt -X POST http://192.168.8.1/cgi-bin/api/login -d '{"username":"guest","password":"guest"}'

# Use the same SID to access admin-only API
curl -b cookies.txt http://192.168.8.1/cgi-bin/api/admin/system

Blue Team (Defensive)

Detection Steps:

1. Monitor for anomalous SID usage: Look for the same SID being used from different IP addresses or for different user roles.
2. Check for brute-force attempts: Multiple rapid SID generation requests.
3. Review logs: GL.iinet devices log authentication events. Look for sid reuse across different users.
4. Network segmentation: Ensure the management interface is not exposed to the internet.

Mitigation (temporary):

• Restrict access to the web interface to trusted IPs only.
• Use a VPN to access the management interface.
• Disable guest accounts if not needed.

Indicators of Compromise (IOCs)

• Network:
  • Multiple authentication requests from the same IP with different SIDs.
  • SID values that are sequential or based on timestamps.
  • Access to admin API endpoints from a non-admin session.
• Host:
  • Unexpected changes to admin password.
  • New firewall rules allowing outbound connections.
  • Modified DNS settings.
• Logs:
  • sid reuse across different user fields in authentication logs.
  • 403 Forbidden followed by 200 OK for the same SID.

Detection Engineering

YARA Rule

rule GLiNet_SID_Bypass {
    meta:
        description = "Detects SID reuse or forgery attempts in GL.iNet logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45261"
    strings:
        $sid_pattern = /sid=[a-f0-9]{32}/  // MD5-like SID
        $user_admin = "admin"
        $user_guest = "guest"
    condition:
        #sid_pattern > 1 and ($user_admin or $user_guest)
}

Sigma Rule

title: GL.iNet SID Reuse Detection
id: cve-2024-45261-sigma
status: experimental
description: Detects potential SID reuse across different users in GL.iNet logs
logsource:
    category: application
    product: glinet
detection:
    selection:
        event: "authentication"
        sid|re: "[a-f0-9]{32}"
    condition:
        selection | count(sid) by user > 1
falsepositives:
    - Legitimate multi-user sessions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45261 GL.iNet SID Reuse Attempt";
    flow:to_server,established;
    content:"/cgi-bin/api/"; http_uri;
    content:"sid="; http_cookie;
    pcre:"/sid=[a-f0-9]{32}/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Do not expose the web interface to the internet. Use a firewall to restrict access to trusted IPs.
2. Disable guest accounts: If guest access is not required, disable it.
3. Monitor logs: Enable detailed logging and monitor for SID anomalies.

Long-term Fix:

• Vendor Patch: Await an official firmware update from GL.iNet that binds SIDs to specific users using cryptographic methods (e.g., HMAC with user-specific secret).
• Workaround: Implement a reverse proxy (e.g., Nginx) in front of the device to enforce additional authentication.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.