CVE-2024-38295
📋 TL;DR
CVE-2024-38295 is a remote code execution vulnerability in ALCASAR network access control software versions before 3.6.1. The vulnerability in still_connected.php allows attackers to execute arbitrary code on affected systems. Organizations running ALCASAR versions below 3.6.1 are affected.
💻 Affected Systems
- ALCASAR
📦 What is this software?
Alcasar by Alcasar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, pivot to other systems, and potentially gain persistent access to the network.
Likely Case
Attackers gain shell access to the ALCASAR server, allowing them to modify configurations, steal credentials, and potentially compromise the entire network access control system.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring that detects exploitation attempts.
🎯 Exploit Status
The vulnerability appears to be in still_connected.php which suggests it may be accessible without authentication. CVSS 9.8 indicates critical severity with low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.1
Vendor Advisory: https://adullact.net/frs/download.php/file/8930/CHANGELOG.md
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download ALCASAR 3.6.1 from official sources. 3. Follow upgrade instructions in documentation. 4. Restart ALCASAR services. 5. Verify functionality post-upgrade.
🔧 Temporary Workarounds
Restrict access to still_connected.php
linuxBlock or restrict access to the vulnerable PHP file using web server configuration or firewall rules.
# Apache: <Location /path/to/still_connected.php> Require all denied </Location>
# Nginx: location ~ /still_connected\.php$ { deny all; }
Network segmentation
linuxIsolate ALCASAR server from untrusted networks and restrict access to necessary ports only.
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the ALCASAR web interface
- Enable detailed logging and monitoring for suspicious activity related to still_connected.php access
🔍 How to Verify
Check if Vulnerable:
Check ALCASAR version via web interface or command line. Versions below 3.6.1 are vulnerable.Check Version:
cat /etc/alcasar/version or check web interface administration panelVerify Fix Applied:
Confirm version is 3.6.1 or higher and test that still_connected.php functionality works without allowing code execution.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to still_connected.php
- Suspicious POST/GET parameters in web logs
- Unexpected process execution from web server context
Network Indicators:
- Unusual outbound connections from ALCASAR server
- Traffic patterns suggesting command and control communication
SIEM Query:
source="web_access_logs" AND uri="*still_connected.php*" AND (param="*cmd*" OR param="*system*" OR param="*exec*")