CVE-2023-0048: Daloradius RCE Vulnerability

CVE-2023-0048 Overview

CVE-2023-0048 is a code injection vulnerability affecting daloRADIUS, an open-source RADIUS web management application commonly used for managing hotspot and ISP deployments. This vulnerability exists in the GitHub repository lirantal/daloradius prior to the master-branch and allows authenticated attackers to inject malicious code through improperly validated user input in critical backup and logging management functions.

Critical Impact

Authenticated attackers can exploit insufficient input validation to inject malicious code, potentially gaining unauthorized access to sensitive system files, executing arbitrary commands, and compromising the entire RADIUS infrastructure.

Affected Products

• daloRADIUS - all versions prior to the security patch
• daloRADIUS deployments using the config-backup-managebackups.php endpoint
• daloRADIUS deployments using the config-logging.php endpoint

Discovery Timeline

• 2023-01-04 - CVE CVE-2023-0048 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-0048

Vulnerability Analysis

This code injection vulnerability stems from insufficient input validation in daloRADIUS's backup management and logging configuration modules. The application fails to properly sanitize user-supplied input via POST parameters before using them in file path operations, creating an exploitable condition for path traversal and code injection attacks.

The vulnerability is particularly dangerous because it allows authenticated users with low privileges to manipulate file operations and potentially access or modify files outside the intended directories. An attacker could leverage this weakness to read sensitive configuration files containing database credentials, inject malicious code into log files, or manipulate backup operations to gain further system access.

Root Cause

The root cause of CVE-2023-0048 is improper input validation in the handling of the file POST parameter within config-backup-managebackups.php and similar validation issues in config-logging.php. The original code directly accepted user-supplied filenames without validating path components, file extensions, or checking for directory traversal sequences like ... This allowed attackers to specify arbitrary file paths that could escape the intended backup or log directories.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the daloRADIUS web interface. An attacker can exploit this vulnerability by:

1. Authenticating to the daloRADIUS management interface with any valid user account
2. Crafting a malicious POST request to vulnerable endpoints with manipulated file parameters
3. Using path traversal sequences (e.g., ../) to escape the intended directory
4. Accessing or manipulating files outside the designated backup/log directories

The following security patch demonstrates how the vulnerability was addressed by implementing proper input validation:

     include("library/layout.php");
     include_once("include/management/functions.php");
 
-    $file = (array_key_exists('file', $_POST) && isset($_POST['file'])) ? $_POST['file'] : "";
+    // validate path
+    $backup_path_prefix = $configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] . "/backup";
+    $backup_file_suffix = ".sql";
+
+    $file = "";
+    if (array_key_exists('file', $_POST) && !empty(trim($_POST['file']))) {
+        $candidate_backup_file = trim($_POST['file']);
+        
+        if (
+                // this ensures that candidate_backup_file does not contain any ".." sequence
+                strpos($candidate_backup_file, "..") === false &&
+                
+                // this ensures that candidate_backup_file does not contain any "/" char
+                strpos($candidate_backup_file, "/") === false &&
+                
+                // this ensures that candidate_backup_file ends with the backup_file_suffix
+                substr($candidate_backup_file, -strlen($backup_file_suffix)) === $backup_file_suffix
+           ) {
+            
+            $file = $candidate_backup_file;
+        }
+        
+    }
 
     $backupAction = (array_key_exists('action', $_POST) && isset($_POST['action']) &&
                      in_array($_POST['action'], array_keys($valid_backupActions))) ? $_POST['action'] : "";

Source: GitHub Commit Details

Detection Methods for CVE-2023-0048

Indicators of Compromise

• Unusual POST requests to /config-backup-managebackups.php or /config-logging.php containing .. sequences in the file parameter
• Web server access logs showing attempts to access files outside the /backup or /logs directories
• Unexpected file access or modification patterns in system audit logs
• Database backup files appearing in unexpected locations

Detection Strategies

• Monitor HTTP request logs for path traversal patterns (../, ..%2f, %2e%2e/) in POST data targeting daloRADIUS endpoints
• Implement Web Application Firewall (WAF) rules to detect and block requests containing directory traversal sequences
• Enable PHP application logging to capture and alert on file operations outside designated directories
• Configure SentinelOne endpoint protection to detect suspicious file access patterns from web server processes

Monitoring Recommendations

• Enable detailed access logging for all daloRADIUS management interfaces
• Set up alerts for any file operations initiated by the web server user outside the expected daloRADIUS directories
• Monitor for changes to critical configuration files including database credentials
• Implement file integrity monitoring (FIM) on daloRADIUS configuration and backup directories

How to Mitigate CVE-2023-0048

Immediate Actions Required

• Update daloRADIUS to the latest version from the master branch containing the security fix
• Review web server access logs for any evidence of exploitation attempts
• Audit all authenticated users with access to daloRADIUS management functions
• Implement network segmentation to limit access to the daloRADIUS management interface

Patch Information

The vulnerability has been addressed in commit 3650eea7277a5c278063214a5b71dbd7d77fc5aa. The patch implements comprehensive input validation that blocks directory traversal sequences, validates file extensions, and ensures files are accessed only within designated directories. Organizations should update to the latest master branch version that includes this fix. For detailed information, refer to the GitHub Commit Details and the Huntr Bounty Report.

Workarounds

• Restrict access to the daloRADIUS management interface to trusted IP addresses only using firewall rules or web server configuration
• Implement additional authentication layers such as VPN or multi-factor authentication for administrative access
• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns in request parameters
• Review and restrict file system permissions for the web server user to minimize impact of successful exploitation

# Apache configuration to restrict daloRADIUS admin access
<Directory /var/www/daloradius>
    <Files "config-backup-managebackups.php">
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </Files>
    <Files "config-logging.php">
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </Files>
</Directory>