CVE-2024-9324
📋 TL;DR
This critical vulnerability in Intelbras InControl allows remote attackers to execute arbitrary code through code injection in the Relatório de Operadores page. It affects InControl versions up to 2.21.57, potentially compromising the entire system. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- Intelbras InControl
📦 What is this software?
Incontrol Web by Intelbras
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, or use as a foothold for lateral movement within the network.
Likely Case
Unauthorized access to sensitive data, system manipulation, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.21.58
Vendor Advisory: https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf
Restart Required: Yes
Instructions:
1. Download INCONTROL-WEB-2.21.58 from Intelbras download portal. 2. Stop InControl service. 3. Install the update. 4. Restart the service.
🔧 Temporary Workarounds
Network Access Restriction
windowsBlock external access to InControl web interface using firewall rules
netsh advfirewall firewall add rule name="Block InControl Web" dir=in action=block protocol=TCP localport=80,443 remoteip=any
Endpoint Protection
allDeploy WAF or IPS rules to detect and block injection attempts
🧯 If You Can't Patch
- Isolate the InControl server in a separate VLAN with strict access controls
- Implement application-level input validation and sanitization for the /v1/operador/ endpoint
🔍 How to Verify
Check if Vulnerable:
Check InControl version in web interface or installation directory. Versions ≤2.21.57 are vulnerable.Check Version:
Check web interface or look for version file in installation directoryVerify Fix Applied:
Verify version is 2.21.58 or higher and test the /v1/operador/ endpoint with injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /v1/operador/ with suspicious parameters
- System commands execution from web process
Network Indicators:
- HTTP requests with code injection patterns to /v1/operador/ endpoint
SIEM Query:
source="web_logs" AND uri="/v1/operador/" AND (param="fields" AND value CONTAINS "system" OR "exec" OR "cmd")🔗 References
- https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf
- https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe
- https://vuldb.com/?ctiid.278828
- https://vuldb.com/?id.278828
- https://vuldb.com/?submit.375614
- https://youtu.be/UdZVktPUy8A
