CVE-2024-44570
📋 TL;DR
RELY-PCIe versions v22.2.1 to v23.1.0 contain a code injection vulnerability in the getParams function within phpinf.php. This allows attackers to execute arbitrary code on affected systems. Organizations using these versions of RELY-PCIe software are at risk.
💻 Affected Systems
- RELY-PCIe
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Unauthenticated attackers executing arbitrary commands to install malware, create backdoors, or pivot to other systems.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
The vulnerability is in a PHP function that likely processes user input without proper sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v23.1.1 or later
Vendor Advisory: https://www.relyum.com/web/support/vulnerability-report/
Restart Required: Yes
Instructions:
1. Download the latest version from the vendor website. 2. Backup current configuration. 3. Install the update following vendor documentation. 4. Restart the RELY-PCIe service.
🔧 Temporary Workarounds
Remove phpinf.php file
linuxDelete or rename the vulnerable phpinf.php file to prevent exploitation.
rm /path/to/phpinf.php
Restrict network access
linuxBlock external access to the RELY-PCIe web interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate the affected system in a restricted network segment with no internet access.
- Implement strict network monitoring and alerting for suspicious activity targeting the RELY-PCIe service.
🔍 How to Verify
Check if Vulnerable:
Check the RELY-PCIe version in the web interface or configuration files.Check Version:
grep -i version /path/to/rely-pcie/config/*.confVerify Fix Applied:
Verify the version is v23.1.1 or later and that phpinf.php no longer exists or has been patched.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to phpinf.php
- Suspicious PHP execution errors in web server logs
- Unexpected process creation from web server user
Network Indicators:
- HTTP requests containing shell commands or encoded payloads
- Outbound connections from the RELY-PCIe server to unknown IPs
SIEM Query:
source="web_server" AND uri="*phpinf.php*" AND (method="POST" OR status>=400)