CVE-2023-50917: Mjdm Majordomo RCE Vulnerability

CVE-2023-50917 Overview

CVE-2023-50917 is a command injection vulnerability in MajorDoMo (Major Domestic Module), an open-source home automation platform. The vulnerability exists in the thumb.php file, which fails to properly sanitize user-supplied input, allowing attackers to inject shell metacharacters and execute arbitrary commands on the underlying system. This flaw enables unauthenticated remote code execution, making it a severe threat to any exposed MajorDoMo installation.

Critical Impact
Unauthenticated attackers can achieve full remote code execution on systems running vulnerable MajorDoMo installations via command injection in thumb.php, potentially compromising the entire home automation infrastructure and connected IoT devices.

Affected Products

MajorDoMo (Major Domestic Module) versions before commit 0662e5e
All MajorDoMo installations with exposed thumb.php endpoint
Home automation systems running unpatched MajorDoMo software

Discovery Timeline

December 2023 - Vulnerability publicly disclosed via Full Disclosure mailing list
2023-12-15 - CVE-2023-50917 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-50917

Vulnerability Analysis

This vulnerability falls under CWE-77 (Improper Neutralization of Special Elements used in a Command). The thumb.php script in MajorDoMo processes user input that is subsequently passed to shell commands without adequate sanitization. An attacker can craft malicious requests containing shell metacharacters that escape the intended command context and execute arbitrary system commands with the privileges of the web server user.

The attack requires no authentication, meaning any network-accessible MajorDoMo installation is at risk. Given that MajorDoMo is a home automation platform, successful exploitation could grant attackers control over connected smart home devices, surveillance systems, and other IoT infrastructure. The vulnerability has an extremely high EPSS score of 92.755% (99th percentile), indicating a very high probability of exploitation in the wild.

Root Cause

The root cause is insufficient input validation and improper handling of shell metacharacters in the thumb.php file. User-controlled input is passed directly to system commands without proper escaping or sanitization, allowing attackers to break out of the intended command context using characters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()).

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted HTTP requests to the thumb.php endpoint containing shell metacharacters. When the server processes these requests, the injected commands are executed in the context of the web server, typically allowing the attacker to:

Execute arbitrary system commands
Download and execute malware
Establish reverse shells for persistent access
Access or modify files on the system
Pivot to attack other devices on the network

The vulnerability is exploited by embedding shell metacharacters in parameters processed by thumb.php. When these parameters are passed to shell commands without proper sanitization, the injected commands are executed. Technical details and proof-of-concept information are available through the Packet Storm RCE Exploit and Full Disclosure Announcement.

Detection Methods for CVE-2023-50917

Indicators of Compromise

Unusual HTTP requests to thumb.php containing shell metacharacters such as ;, |, &, backticks, or $()
Web server access logs showing requests with URL-encoded command sequences targeting thumb.php
Unexpected child processes spawned from the web server process (Apache, nginx, PHP-FPM)
Outbound network connections from the MajorDoMo server to unknown external hosts

Detection Strategies

Deploy web application firewall (WAF) rules to block requests containing shell metacharacters in parameters sent to thumb.php
Monitor HTTP access logs for patterns indicative of command injection attempts, such as %3B, %7C, %60, or %24%28 sequences
Implement endpoint detection to alert on suspicious process chains originating from web server processes
Review file integrity monitoring alerts for unexpected modifications to MajorDoMo installation files

Monitoring Recommendations

Enable verbose logging for the web server hosting MajorDoMo and centralize logs for analysis
Configure alerts for any outbound connections from the MajorDoMo server to external IP addresses on non-standard ports
Monitor system process trees for shells or command interpreters spawned by PHP or the web server
Implement network segmentation monitoring to detect lateral movement from compromised home automation systems

How to Mitigate CVE-2023-50917

Immediate Actions Required

Update MajorDoMo to a version that includes commit 0662e5e or later immediately
If patching is not immediately possible, restrict network access to the MajorDoMo installation using firewall rules
Review web server logs for evidence of exploitation attempts or successful attacks
Consider taking vulnerable instances offline until patching is complete

Patch Information

The vulnerability has been addressed in the MajorDoMo GitHub repository. The fix is available in the following commits:

Commit 0662e5e - Primary security fix
Commit 3ec3ffb - Additional hardening

Users should pull the latest code from the repository or update to a release version that includes these commits. Verify the integrity of your installation after updating.

Workarounds

Implement strict firewall rules to prevent external access to the MajorDoMo web interface, limiting access to trusted internal networks only
Deploy a reverse proxy with WAF capabilities in front of MajorDoMo to filter malicious requests containing shell metacharacters
Disable or remove the thumb.php file if the thumbnail functionality is not required for your deployment
Run the MajorDoMo web server under a restricted user account with minimal filesystem and system permissions

bash

# Example firewall configuration to restrict access to MajorDoMo
# Allow only local network access to MajorDoMo (adjust subnet as needed)
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP