CVE-2024-6185
📋 TL;DR
This critical vulnerability in Ruijie RG-UAC 1.0 allows remote attackers to execute arbitrary operating system commands via command injection in the get_ip_addr_details function. Attackers can exploit this by manipulating the ethname parameter in the /view/dhcp/dhcpConfig/commit.php file. Organizations using Ruijie RG-UAC 1.0 are affected.
💻 Affected Systems
- Ruijie RG-UAC
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with system privileges, install malware, pivot to other systems, and exfiltrate sensitive data.
Likely Case
Remote code execution leading to unauthorized access, data theft, and potential ransomware deployment on affected Ruijie devices.
If Mitigated
Limited impact with proper network segmentation, but still potential for device compromise within isolated segments.
🎯 Exploit Status
Public exploit code is available, and the vulnerability requires no authentication, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Contact Ruijie support for updates. Consider workarounds or replacement if vendor remains unresponsive.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to the vulnerable endpoint to trusted IP addresses only
iptables -A INPUT -p tcp --dport [WEB_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [WEB_PORT] -j DROP
Web Application Firewall
allDeploy WAF rules to block command injection patterns in the ethname parameter
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict firewall rules preventing outbound connections
- Implement network monitoring and intrusion detection specifically for command injection attempts to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your device is Ruijie RG-UAC version 1.0 and has the /view/dhcp/dhcpConfig/commit.php endpoint accessibleCheck Version:
Check web interface or console for firmware version informationVerify Fix Applied:
Test if command injection via ethname parameter is still possible using safe test payloads like ';echo test;'📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /view/dhcp/dhcpConfig/commit.php with shell metacharacters in parameters
- System logs showing unexpected command execution
Network Indicators:
- HTTP requests containing shell commands in POST parameters
- Outbound connections from Ruijie device to unexpected destinations
SIEM Query:
source="ruijie_web_logs" AND uri="/view/dhcp/dhcpConfig/commit.php" AND (param="ethname" AND value MATCHES "[;&|`$()]+")🔗 References
- https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_b.md
- https://vuldb.com/?ctiid.269156
- https://vuldb.com/?id.269156
- https://vuldb.com/?submit.354121
- https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_b.md
- https://vuldb.com/?ctiid.269156
- https://vuldb.com/?id.269156
- https://vuldb.com/?submit.354121
