CVE-2020-23151
📋 TL;DR
CVE-2020-23151 is a critical command injection vulnerability in rConfig that allows attackers to execute arbitrary commands on the server. The vulnerability affects rConfig 3.9.5 installations where the ajaxArchiveFiles.php script is accessible. Attackers can exploit this by sending specially crafted GET requests containing shell commands.
💻 Affected Systems
- rConfig
📦 What is this software?
Rconfig by Rconfig
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with web server privileges, potentially leading to data theft, system takeover, or lateral movement within the network.
Likely Case
Remote code execution leading to web shell installation, data exfiltration, or use as a foothold for further attacks.
If Mitigated
Limited impact if proper network segmentation, web application firewalls, and input validation are implemented.
🎯 Exploit Status
Exploitation requires sending a simple HTTP GET request with malicious parameters. Multiple public proof-of-concept exploits are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.6 and later
Vendor Advisory: https://github.com/rconfig/rconfig/releases
Restart Required: No
Instructions:
1. Backup your rConfig installation and database. 2. Download rConfig 3.9.6 or later from the official repository. 3. Replace the vulnerable ajaxArchiveFiles.php file with the patched version. 4. Verify the fix by checking that input validation is now properly implemented.
🔧 Temporary Workarounds
Disable vulnerable endpoint
linuxRemove or restrict access to the vulnerable PHP script
mv /var/www/html/lib/ajaxHandlers/ajaxArchiveFiles.php /var/www/html/lib/ajaxHandlers/ajaxArchiveFiles.php.disabled
chmod 000 /var/www/html/lib/ajaxHandlers/ajaxArchiveFiles.php.disabled
Web Application Firewall rule
allBlock requests containing shell metacharacters in the path parameter
ModSecurity rule: SecRule ARGS:path "[;|&`$()]" "id:1001,phase:2,deny,status:403,msg:'Command injection attempt'"
nginx: location ~* "/lib/ajaxHandlers/ajaxArchiveFiles\.php" { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate rConfig from critical systems
- Deploy a web application firewall with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if the file /lib/ajaxHandlers/ajaxArchiveFiles.php exists and contains the vulnerable exec() call without proper input sanitizationCheck Version:
grep -r 'rConfig version' /var/www/html/ || cat /var/www/html/install/version.txtVerify Fix Applied:
Verify that the ajaxArchiveFiles.php file now validates and sanitizes the 'path' parameter before passing it to exec()📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /lib/ajaxHandlers/ajaxArchiveFiles.php with unusual parameters
- Web server logs showing shell metacharacters in URL parameters
- System logs showing unexpected command execution from web server user
Network Indicators:
- HTTP requests containing shell metacharacters (;, |, &, `, $, (, )) in query parameters
- Unusual outbound connections from the rConfig server
SIEM Query:
source="web_server" AND (url="*ajaxArchiveFiles.php*" AND (param="*;*" OR param="*|*" OR param="*&*" OR param="*`*" OR param="*$(*"))🔗 References
- https://cwe.mitre.org/data/definitions/78.html
- https://github.com/rconfig/rconfig/blob/7ef8bd8d606bc10835e1b8f6f72a2048094816d3/www/lib/ajaxHandlers/ajaxArchiveFiles.php#L13
- https://cwe.mitre.org/data/definitions/78.html
- https://github.com/rconfig/rconfig/blob/7ef8bd8d606bc10835e1b8f6f72a2048094816d3/www/lib/ajaxHandlers/ajaxArchiveFiles.php#L13
