CVE-2024-55514

Executive Summary

CVE-2024-55514 is a critical unauthenticated arbitrary file upload vulnerability affecting multiple Raisecom MSG series industrial routers, including MSG1200, MSG2100E, MSG2200, and MSG2300 running firmware version 3.90. The vulnerability resides in the /upload_sfmig.php endpoint on the web interface. By crafting a suitable form name, an attacker can upload arbitrary files to the server, potentially leading to remote code execution, persistent backdoor installation, or complete compromise of the device. No patch is currently available from the vendor, and no public proof-of-concept exploit has been released. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and aligns with MITRE ATT&CK technique T1190 (Exploit Public-Facing Application).

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): High (H) – arbitrary file upload can lead to data exfiltration.
• Integrity (I): High (H) – attacker can modify system files.
• Availability (A): High (H) – can overwrite critical files causing denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is unpatched, affects network infrastructure devices, and requires no authentication. Exploitation could lead to full device compromise and lateral movement within the network.

Deep Dive & Mechanics

The vulnerability exists in the /upload_sfmig.php script, which is part of the web interface for managing firmware and configuration files on Raisecom MSG series routers. The script does not properly validate the form name parameter or the uploaded file type. By manipulating the form name (e.g., using path traversal characters like ../ or null bytes), an attacker can bypass intended upload restrictions and write files to arbitrary directories on the filesystem.

The typical upload flow:

1. The web server receives a multipart POST request to /upload_sfmig.php.
2. The script extracts the form name from the request.
3. The script uses the form name to construct the destination path for the uploaded file.
4. Due to insufficient sanitization, an attacker can inject directory traversal sequences (e.g., ../../../etc/passwd) or specify a filename with a dangerous extension (e.g., .php).

This allows an attacker to:

• Upload a web shell to the web root (e.g., /var/www/html/shell.php).
• Overwrite critical system files (e.g., /etc/shadow, /etc/passwd).
• Upload malicious firmware images to trigger further exploitation.

The vulnerability is particularly dangerous because the web interface is typically exposed on the network, and no authentication is required to access the upload endpoint.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

Vulnerable Code (PHP-like pseudocode):

<?php
$upload_dir = "/var/www/uploads/";
$form_name = $_POST['form_name'];
$target_file = $upload_dir . $form_name;
move_uploaded_file($_FILES['file']['tmp_name'], $target_file);
?>

Patched Code (Expected):

<?php
$upload_dir = "/var/www/uploads/";
$form_name = basename($_POST['form_name']); // Remove path components
$allowed_ext = ['bin', 'img', 'cfg'];
$ext = pathinfo($form_name, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_ext)) {
    die("Invalid file type.");
}
$target_file = $upload_dir . $form_name;
move_uploaded_file($_FILES['file']['tmp_name'], $target_file);
?>

The patched version uses basename() to strip directory traversal sequences and validates the file extension against a whitelist.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Raisecom MSG1200/2100E/2200/2300 device or use a firmware emulator (e.g., QEMU with extracted firmware).
2. Ensure the web interface is accessible on port 80 or 443.
3. Prepare a malicious PHP web shell (e.g., shell.php).

Exploitation Steps:

1. Craft a POST request to /upload_sfmig.php with a manipulated form name to achieve directory traversal.
2. Example using curl:

   curl -X POST http://target/upload_sfmig.php \
     -F "form_name=../../../var/www/html/shell.php" \
     -F "file=@shell.php"
   

3. Access the uploaded shell:

   curl http://target/shell.php?cmd=id
   

Alternative Payload:

• Upload a malicious firmware image to trigger a firmware downgrade or backdoor installation.

Blue Team

Detection:

• Monitor HTTP POST requests to /upload_sfmig.php with unusual form_name parameters containing ../ or null bytes.
• Alert on file uploads with unexpected extensions (e.g., .php, .asp, .jsp) to the web root.
• Use file integrity monitoring (FIM) to detect new or modified files in sensitive directories.

Hunting:

• Search web server logs for requests to /upload_sfmig.php with form_name containing path traversal patterns.
• Look for files with suspicious names in /var/www/html/ or /tmp/ that were not part of the original firmware.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /upload_sfmig.php with form_name containing ../ or %2e%2e%2f.
  • Outbound connections from the device to unknown IPs on ports 80/443/4444.
• File System:
  • Unexpected files in /var/www/html/ with .php, .asp, or .jsp extensions.
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • Presence of web shells (e.g., shell.php, cmd.php).
• Process:
  • Unusual processes spawned by the web server (e.g., /bin/sh, /bin/bash).
• Logs:
  • Web server logs showing successful uploads to /upload_sfmig.php with non-standard form names.

Detection Engineering

YARA Rule

rule CVE_2024_55514_WebShell_Upload {
    meta:
        description = "Detects web shell upload attempts targeting CVE-2024-55514"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-55514"
    strings:
        $upload_endpoint = "/upload_sfmig.php"
        $path_traversal = /\.\.\//
        $php_shell = /<\?php\s+system\(/
    condition:
        $upload_endpoint and ($path_traversal or $php_shell)
}

Sigma Rule

title: CVE-2024-55514 - Unauthenticated File Upload via /upload_sfmig.php
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /upload_sfmig.php with path traversal in form_name
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload_sfmig.php'
        cs-uri-query|contains: 'form_name='
    filter:
        cs-uri-query|contains: 'form_name=../../../'
    condition: selection and filter
falsepositives:
    - Legitimate firmware uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55514 - Unauthenticated File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload_sfmig.php"; http_uri; content:"form_name"; http_client_body; pcre:"/\.\.\//"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Raisecom MSG series routers from untrusted networks (e.g., the internet) until a patch is available.
2. Restrict access: Use firewall rules to limit access to the web interface (port 80/443) to trusted IPs only.
3. Disable upload functionality: If possible, remove or disable the /upload_sfmig.php script on the device.

Long-term Actions:

1. Vendor patch: Monitor Raisecom's official channels for a firmware update that fixes the vulnerability.
2. Network segmentation: Place these devices in a separate VLAN with strict access controls.
3. Web application firewall (WAF): Deploy a WAF rule to block requests to /upload_sfmig.php with path traversal patterns.
4. Regular audits: Conduct periodic security assessments of network infrastructure devices.

Workaround:

• If the upload functionality is not required, block the endpoint at the reverse proxy or load balancer level:

  location /upload_sfmig.php {
      deny all;
  }
  

Valters IT
DevSecOps & Cyber Threat Intelligence