CVE-2020-24032
📋 TL;DR
CVE-2020-24032 is a command injection vulnerability in tz.pl on XoruX LPAR2RRD and STOR2RRD virtual appliances that allows attackers to execute arbitrary commands via shell metacharacters in the timezone parameter. This affects organizations using these monitoring appliances for IBM Power systems and storage systems. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- XoruX LPAR2RRD
- XoruX STOR2RRD
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands as the web server user, potentially leading to data theft, system destruction, or lateral movement within the network.
Likely Case
Remote code execution leading to installation of backdoors, cryptocurrency miners, or data exfiltration from the monitoring system.
If Mitigated
Limited impact if network segmentation prevents external access and proper input validation is implemented.
🎯 Exploit Status
Exploit details are publicly available on Pastebin showing simple command injection via the tz parameter. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.70
Vendor Advisory: https://www.stor2rrd.com/download.php
Restart Required: Yes
Instructions:
1. Download the latest version from the vendor website. 2. Backup current configuration. 3. Install the updated version. 4. Restart the appliance services.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the appliance web interface to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Input Validation Patch
linuxAdd input validation to sanitize the tz parameter in tz.pl script.
sed -i "s/\$ENV{'tz'}/\$tz =~ \/^[A-Za-z0-9\/\-_]+\$/ ? \$ENV{'tz'} : 'UTC'/g" /path/to/tz.pl
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the appliance from untrusted networks.
- Deploy a web application firewall (WAF) with command injection rules in front of the appliance.
🔍 How to Verify
Check if Vulnerable:
Check if the appliance version is 2.70 by accessing the web interface and reviewing version information, or check the installed package version.Check Version:
grep -i version /opt/stor2rrd/version.txt || grep -i version /opt/lpar2rrd/version.txtVerify Fix Applied:
Verify the appliance version is updated beyond 2.70 and test the tz parameter with shell metacharacters to ensure command injection is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in web server logs containing shell metacharacters in tz parameter
- Suspicious process execution from the web server user account
Network Indicators:
- HTTP requests to tz.pl with shell metacharacters in parameters
- Outbound connections from the appliance to unexpected destinations
SIEM Query:
source="web_logs" AND uri="*tz.pl*" AND (param="*;*" OR param="*|*" OR param="*`*" OR param="*$(*")