CVE-2024-55918

Executive Summary

CVE-2024-55918 is a security vulnerability in the Perl module Graphics::ColorNames affecting versions before 3.2.0. The vulnerability arises from an ambiguity between module names and filenames, which can be exploited by an attacker who can create a file in the current working directory. This can lead to HTML injection, potentially allowing an attacker to execute arbitrary code or inject malicious content into web applications that use this module. The vulnerability has a CVSS score of 0.0, indicating that it has not been officially scored, but the potential impact is significant due to the risk of code execution and data manipulation.

Supply Chain & Package Security

This vulnerability is specific to the Perl ecosystem and the Graphics::ColorNames package. It highlights a supply chain risk where an attacker can exploit the module loading mechanism by placing a malicious file in the current working directory. This can lead to the execution of arbitrary code, compromising the integrity of applications that depend on this module. Organizations using Perl applications that rely on Graphics::ColorNames should immediately assess their exposure and apply the patch.

CVSS Breakdown & Threat Level

The CVSS score for CVE-2024-55918 is 0.0, which is unusual and likely indicates that the score has not been assigned or is pending. However, based on the vulnerability description, the threat level is considered High due to the potential for code execution and HTML injection. The attack vector is local, requiring the attacker to have the ability to create files in the current working directory, but the impact on confidentiality, integrity, and availability can be severe.

Deep Dive & Mechanics

The vulnerability in Graphics::ColorNames is rooted in how Perl resolves module names to file paths. When the module is loaded, Perl searches for a file matching the module name in the current working directory before checking the standard library paths. An attacker who can create a file with a name that matches a module used by Graphics::ColorNames can cause Perl to load that malicious file instead of the legitimate module. This can lead to HTML injection if the module is used to generate HTML content, as the attacker can control the output.

The ambiguity between modules and filenames is a classic Perl issue, often referred to as "module name collision." In this case, the attacker can exploit this by placing a file named Graphics/ColorNames.pm or a similar path in the current working directory, which Perl will load before the system-installed module.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.2.0): The vulnerable version does not sanitize or validate the module loading path, allowing Perl to load modules from the current working directory.

# Example of vulnerable usage
use Graphics::ColorNames;
# This could load a malicious file from the current directory

Patched Code (version 3.2.0 and later): The patched version likely includes changes to restrict module loading to trusted directories or to sanitize the module name to prevent path traversal.

# Example of patched usage
use Graphics::ColorNames;
# The module now ensures it loads from a safe path

The exact patch details are not provided, but the fix involves ensuring that the module is loaded from a secure location, such as the system library path, and not from the current working directory.

Exploitation & Lab Setup

Red Team

To exploit CVE-2024-55918, an attacker needs to create a malicious file in the current working directory of a Perl script that uses Graphics::ColorNames. The file should be named to match a module that the script will load. For example, if the script uses Graphics::ColorNames::HTML, the attacker can create a file named Graphics/ColorNames/HTML.pm in the current directory.

Exploit Code (Conceptual):

# malicious_Graphics_ColorNames_HTML.pm
package Graphics::ColorNames::HTML;
sub new {
    my $class = shift;
    print "Content-Type: text/html\n\n";
    print "<script>alert('XSS')</script>";
    bless {}, $class;
}
1;

The attacker then places this file in the current working directory and runs the vulnerable Perl script. The script will load the malicious module, leading to HTML injection.

Blue Team

To detect exploitation attempts, monitor for unusual file creation in directories where Perl scripts are executed. Look for files with names that match Perl module paths (e.g., Graphics/ColorNames.pm). Additionally, monitor Perl script execution for unexpected module loading behavior.

Detection Steps:

1. Monitor file system events for creation of files in directories where Perl scripts run.
2. Use file integrity monitoring to detect changes to Perl module directories.
3. Analyze Perl script logs for errors related to module loading.

Indicators of Compromise (IOCs)

• File Hashes: (None provided, but monitor for suspicious .pm files)
• Network Indicators: Unusual HTTP responses containing injected HTML or JavaScript.
• Process Indicators: Perl processes loading modules from unexpected paths.
• File System Indicators: Presence of files like Graphics/ColorNames.pm in non-standard directories.

Detection Engineering

YARA Rule

rule Detect_Malicious_Perl_Module {
    meta:
        description = "Detects malicious Perl module files that may exploit CVE-2024-55918"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $module_path = "Graphics/ColorNames"
        $perl_code = "package Graphics::ColorNames"
    condition:
        $module_path or $perl_code
}

Sigma Rule

title: Detection of Suspicious Perl Module Loading
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Perl scripts loading modules from the current working directory
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/perl'
        CommandLine|contains: 'Graphics::ColorNames'
    condition: selection
falsepositives:
    - Legitimate use of Graphics::ColorNames from standard paths
level: high

Suricata Rule

alert http any any -> any any (msg:"Potential HTML Injection via Graphics::ColorNames"; content:"Graphics::ColorNames"; http_header; content:"<script>"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Graphics::ColorNames to version 3.2.0 or later.
2. Workaround: If patching is not possible, ensure that Perl scripts using this module are executed from directories that do not contain untrusted files.
3. Secure Configuration: Set the PERL5LIB environment variable to only include trusted directories.
4. Monitoring: Implement file integrity monitoring and log analysis to detect unauthorized file creation.
5. Code Review: Review Perl scripts for any use of use lib or use statements that could load modules from untrusted paths.

Valters IT