CVE-2024-4502
📋 TL;DR
This critical vulnerability in Ruijie RG-UAC Unified Internet Behavior Management Audit System allows remote attackers to execute arbitrary operating system commands via command injection in the ifName parameter of the dhcp_client_commit.php file. Attackers can exploit this to gain unauthorized access and control over affected systems. All Ruijie RG-UAC systems up to version 20240428 are vulnerable.
💻 Affected Systems
- Ruijie RG-UAC Unified Internet Behavior Management Audit System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with system privileges, install malware, exfiltrate sensitive data, pivot to other network systems, and establish persistent backdoors.
Likely Case
Remote code execution leading to unauthorized system access, data theft, and potential use as a foothold for lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, strict firewall rules, and input validation are in place, though the vulnerability remains exploitable.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. The vulnerability can be exploited remotely without authentication using simple HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Monitor Ruijie's official channels for security updates. Consider upgrading to newer versions if available.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
linuxRestrict network access to the vulnerable PHP file using firewall rules or web server configuration.
# Example iptables rule to block access to the vulnerable endpoint
sudo iptables -A INPUT -p tcp --dport 80 -m string --string "/view/dhcp/dhcpClient/dhcp_client_commit.php" --algo bm -j DROP
# Alternative: Use web server configuration to deny access to the specific file
Input Validation via WAF
allImplement web application firewall rules to block malicious input containing command injection patterns.
# Example ModSecurity rule
SecRule ARGS:ifName "@rx [;&|`$()]" "id:1001,phase:2,deny,msg:'Command Injection Attempt'"
# Configure WAF to block requests with suspicious characters in ifName parameter
🧯 If You Can't Patch
- Isolate affected systems in a separate network segment with strict firewall rules limiting inbound and outbound connections.
- Implement network monitoring and intrusion detection systems to detect exploitation attempts and anomalous system behavior.
🔍 How to Verify
Check if Vulnerable:
Check if the file /view/dhcp/dhcpClient/dhcp_client_commit.php exists and is accessible via HTTP. Test by sending a request with a command injection payload in the ifName parameter (use caution in production).Check Version:
Check system version through web interface or administrative console. The exact command varies by deployment.Verify Fix Applied:
Verify that the vulnerable endpoint is no longer accessible or that input validation properly sanitizes the ifName parameter. Test with safe payloads to confirm command injection is blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to /view/dhcp/dhcpClient/dhcp_client_commit.php with suspicious parameters
- System logs showing unexpected command execution or process creation
- Web server logs containing command injection patterns (;, &, |, `, $, (, )) in ifName parameter
Network Indicators:
- HTTP traffic to the vulnerable endpoint with unusual payloads
- Outbound connections from the system to unexpected external IPs following exploitation
SIEM Query:
source="web_server" AND url="/view/dhcp/dhcpClient/dhcp_client_commit.php" AND (ifName="*;*" OR ifName="*&*" OR ifName="*|*" OR ifName="*`*" OR ifName="*$(*" OR ifName="*)*")🔗 References
- https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_dhcp_dhcpClient_dhcp_client_commit.php.pdf
- https://vuldb.com/?ctiid.263106
- https://vuldb.com/?id.263106
- https://vuldb.com/?submit.323811
- https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_dhcp_dhcpClient_dhcp_client_commit.php.pdf
- https://vuldb.com/?ctiid.263106
- https://vuldb.com/?id.263106
- https://vuldb.com/?submit.323811
