oiivr/turvan6rkus-cve-2024-3273Turvanõrkuse CVE 2024 3273 analüüs: D-Link seadmete käsusüst
D-Link Network Attached Storage (NAS) device is a hard drive (or drives) device connected to a computer network for file storage and sharing. Unlike a regular external hard drive that is directly interfaced with a computer, a NAS device connects to a local network, allowing multiple users or devices to simultaneously access and share files. NAS devices are used in both home and business solutions.
The security research company VulDB Coordination discovered a critical vulnerability (CVE-2024-3273) in some D-Link NAS devices that allows malicious users to perform command injection over the network, executing malicious program commands on the victim's device.
This vulnerability only affects certain D-Link devices that have reached end-of-life and the manufacturer has discontinued software and hardware support. The following models are affected:
This vulnerability also requires the simultaneous exploitation of another weakness. Specifically, the NAS device is made particularly vulnerable by a backdoor caused by hardcoded login credentials. This backdoor is vulnerability (CVE-2024-3272), where a user can bypass authentication by using the default "system user" messagebus present in all affected devices.
This default system daemon user in Linux systems cannot directly log into the system, but a skillfully crafted HTTP request to a specific endpoint is enough to cause damage.
You also need to know the target device's ip address.
The vulnerability lies in the HTTP GET request processing function of the /cgi-bin/nas_sharing.cgi file on the NAS device. A malicious user can send a GET request over the network to the victim's device, providing the username "messagebus" and leaving the password empty. Command injection comes into play here using the system parameter, setting the parameter's value to the desired program command.
The command is hidden using base64 encoding and added as the value of the system parameter. Later, when decoded, the malicious command snippet reveals itself and executes as a shell command on the targeted device.
🗒️ CVSS Base Score: 7.3 High
The cause of the vulnerability CVE-2024-3273 is CWE-77, i.e., command injection. This means an attacker can inject malicious commands, which the targeted system then executes, because the input command is not validated.
Since the device source code is not public, presumably the problem would be avoided by adding a validation function to the method handling requests. For example, there could be a list of allowed system commands to prevent arbitrary command execution.
The vulnerability primarily compromises the following security objectives:
This vulnerability only affects devices that have reached end-of-life, so the manufacturer recommends replacing the devices and not using vulnerable devices.
Since these devices are no longer supported, they cannot receive software security updates, meaning the vulnerability will not be fixed. Therefore, the only solution is to discontinue the use of vulnerable products.
If replacing the vulnerable device is not possible, the device should definitely be removed from the public network and, at most, be used only on a local network with devices (a firewall should be installed to block external requests).
According to the initial report, at the time of discovery, there were over 92,000 devices on the network. According to a later study, this number may have been significantly lower, around 5,500 devices. Nevertheless, many old devices are likely still connected to the network and thus vulnerable.
Multiple proof-of-concept (PoC) exploits have been published, and the vulnerability is likely still widely exploited. To date, at least 146 cases have been discovered where attempts were made to exploit the CVE-2024-3273 vulnerability.
Snippet of example code:
def execute_command(ip, command: str = "id", verbose: bool = True) -> str:
command_hex = ''.join(f'\\\\x{ord(c):02x}' for c in command)
command_final = f"echo -e {command_hex}|sh".replace(' ', '\t')
base64_cmd: str = base64.b64encode(command_final.encode()).decode()
url: str = f"{ip}/cgi-bin/nas_sharing.cgi"
params: dict = {
"user": "messagebus",
"passwd": "",
"cmd": "15",
"system": base64_cmd,
}