CVE-2023-50917: Mjdm Majordomo RCE Vulnerability

CVE-2023-50917 Overview

CVE-2023-50917 is a command injection vulnerability in MajorDoMo (Major Domestic Module), an open-source home automation platform. The vulnerability exists in the thumb.php file, which fails to properly sanitize user-supplied input, allowing attackers to inject shell metacharacters and execute arbitrary commands on the underlying system. This flaw enables unauthenticated remote code execution, making it a severe threat to any exposed MajorDoMo installation.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on systems running vulnerable MajorDoMo installations via command injection in thumb.php, potentially compromising the entire home automation infrastructure and connected IoT devices.

Affected Products

• MajorDoMo (Major Domestic Module) versions before commit 0662e5e
• All MajorDoMo installations with exposed thumb.php endpoint
• Home automation systems running unpatched MajorDoMo software

Discovery Timeline

• December 2023 - Vulnerability publicly disclosed via Full Disclosure mailing list
• 2023-12-15 - CVE-2023-50917 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-50917

Vulnerability Analysis

This vulnerability falls under CWE-77 (Improper Neutralization of Special Elements used in a Command). The thumb.php script in MajorDoMo processes user input that is subsequently passed to shell commands without adequate sanitization. An attacker can craft malicious requests containing shell metacharacters that escape the intended command context and execute arbitrary system commands with the privileges of the web server user.

The attack requires no authentication, meaning any network-accessible MajorDoMo installation is at risk. Given that MajorDoMo is a home automation platform, successful exploitation could grant attackers control over connected smart home devices, surveillance systems, and other IoT infrastructure. The vulnerability has an extremely high EPSS score of 92.755% (99th percentile), indicating a very high probability of exploitation in the wild.

Root Cause

The root cause is insufficient input validation and improper handling of shell metacharacters in the thumb.php file. User-controlled input is passed directly to system commands without proper escaping or sanitization, allowing attackers to break out of the intended command context using characters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()).

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted HTTP requests to the thumb.php endpoint containing shell metacharacters. When the server processes these requests, the injected commands are executed in the context of the web server, typically allowing the attacker to:

• Execute arbitrary system commands
• Download and execute malware
• Establish reverse shells for persistent access
• Access or modify files on the system
• Pivot to attack other devices on the network

The vulnerability is exploited by embedding shell metacharacters in parameters processed by thumb.php. When these parameters are passed to shell commands without proper sanitization, the injected commands are executed. Technical details and proof-of-concept information are available through the Packet Storm RCE Exploit and Full Disclosure Announcement.

Detection Methods for CVE-2023-50917

Indicators of Compromise

• Unusual HTTP requests to thumb.php containing shell metacharacters such as ;, |, &, backticks, or $()
• Web server access logs showing requests with URL-encoded command sequences targeting thumb.php
• Unexpected child processes spawned from the web server process (Apache, nginx, PHP-FPM)
• Outbound network connections from the MajorDoMo server to unknown external hosts

Detection Strategies

• Deploy web application firewall (WAF) rules to block requests containing shell metacharacters in parameters sent to thumb.php
• Monitor HTTP access logs for patterns indicative of command injection attempts, such as %3B, %7C, %60, or %24%28 sequences
• Implement endpoint detection to alert on suspicious process chains originating from web server processes
• Review file integrity monitoring alerts for unexpected modifications to MajorDoMo installation files

Monitoring Recommendations

• Enable verbose logging for the web server hosting MajorDoMo and centralize logs for analysis
• Configure alerts for any outbound connections from the MajorDoMo server to external IP addresses on non-standard ports
• Monitor system process trees for shells or command interpreters spawned by PHP or the web server
• Implement network segmentation monitoring to detect lateral movement from compromised home automation systems

How to Mitigate CVE-2023-50917

Immediate Actions Required

• Update MajorDoMo to a version that includes commit 0662e5e or later immediately
• If patching is not immediately possible, restrict network access to the MajorDoMo installation using firewall rules
• Review web server logs for evidence of exploitation attempts or successful attacks
• Consider taking vulnerable instances offline until patching is complete

Patch Information

The vulnerability has been addressed in the MajorDoMo GitHub repository. The fix is available in the following commits:

• Commit 0662e5e - Primary security fix
• Commit 3ec3ffb - Additional hardening

Users should pull the latest code from the repository or update to a release version that includes these commits. Verify the integrity of your installation after updating.

Workarounds

• Implement strict firewall rules to prevent external access to the MajorDoMo web interface, limiting access to trusted internal networks only
• Deploy a reverse proxy with WAF capabilities in front of MajorDoMo to filter malicious requests containing shell metacharacters
• Disable or remove the thumb.php file if the thumbnail functionality is not required for your deployment
• Run the MajorDoMo web server under a restricted user account with minimal filesystem and system permissions

# Example firewall configuration to restrict access to MajorDoMo
# Allow only local network access to MajorDoMo (adjust subnet as needed)
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP