CVE-2024-1115: Openbi RCE Vulnerability via Command Injection

CVE-2024-1115 Overview

A critical OS command injection vulnerability has been discovered in openBI up to version 1.0.8. This vulnerability exists in the dlfile function within the file /application/websocket/controller/Setting.php. An attacker can remotely exploit this flaw by manipulating the phpPath argument, allowing arbitrary operating system commands to be executed on the underlying server.

Critical Impact

This vulnerability enables unauthenticated remote attackers to execute arbitrary OS commands on affected openBI installations, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• openBI versions up to and including 1.0.8

Discovery Timeline

• 2024-01-31 - CVE-2024-1115 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1115

Vulnerability Analysis

This vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The flaw resides in the dlfile function of the openBI application's WebSocket controller. The vulnerability occurs because user-supplied input to the phpPath parameter is not properly sanitized before being used in system command execution.

OpenBI is a business intelligence platform, and this particular vulnerability affects its WebSocket-based settings controller. The exploit has been publicly disclosed, increasing the risk of exploitation by malicious actors. The vulnerability can be exploited remotely without requiring any authentication or user interaction, making it particularly dangerous for internet-facing deployments.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the dlfile function. When the phpPath argument is processed, the application fails to properly escape or validate the input before incorporating it into an operating system command. This allows attackers to inject malicious command sequences that are then executed with the privileges of the web application process.

Attack Vector

The attack can be initiated remotely over the network. An attacker sends a specially crafted request to the vulnerable endpoint at /application/websocket/controller/Setting.php, manipulating the phpPath parameter to include malicious OS commands. Since no authentication is required, any remote attacker with network access to the vulnerable openBI instance can exploit this vulnerability.

The attack leverages the WebSocket controller's settings functionality, where the phpPath parameter is expected to contain a file path but can be injected with shell metacharacters and additional commands. Common injection techniques include command chaining using semicolons, pipes, or backticks to execute arbitrary commands alongside or instead of the intended operation.

Detection Methods for CVE-2024-1115

Indicators of Compromise

• Unusual outbound network connections from the openBI server to unknown external hosts
• Unexpected process spawning from the web server or PHP process, particularly shell processes like /bin/sh or /bin/bash
• Anomalous entries in web server access logs showing requests to /application/websocket/controller/Setting.php with suspicious phpPath parameters containing shell metacharacters
• Creation of unexpected files or modifications to system configuration files

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block OS command injection patterns in request parameters
• Monitor web application logs for requests containing common command injection payloads such as ;, |, &&, backticks, or $() in the phpPath parameter
• Deploy intrusion detection systems (IDS) with signatures for command injection attempts targeting PHP applications
• Enable audit logging for process execution on servers hosting openBI to detect anomalous command execution

Monitoring Recommendations

• Configure SIEM alerts for suspicious HTTP requests targeting the vulnerable endpoint /application/websocket/controller/Setting.php
• Monitor for unexpected child processes spawned by the web server or PHP-FPM processes
• Set up file integrity monitoring on critical system directories to detect unauthorized modifications
• Review network traffic logs for unusual data exfiltration patterns or command-and-control communication

How to Mitigate CVE-2024-1115

Immediate Actions Required

• Restrict network access to openBI installations to trusted IP ranges only
• Implement WAF rules to block command injection patterns in requests to the affected endpoint
• Consider temporarily disabling the WebSocket settings functionality if not critical to operations
• Audit access logs for any signs of prior exploitation attempts

Patch Information

Users should check the official openBI repository or vendor communications for security patches addressing this vulnerability. The vulnerability affects openBI versions up to and including 1.0.8. Organizations should upgrade to a patched version as soon as one becomes available. Additional technical details can be found in the VulDB advisory and Zhao Jin's security notes.

Workarounds

• Implement strict input validation on the phpPath parameter at the application level, rejecting any input containing shell metacharacters
• Deploy a reverse proxy or WAF in front of openBI to filter malicious requests before they reach the application
• Restrict access to the /application/websocket/controller/Setting.php endpoint using web server configuration
• Run the openBI application with minimal system privileges to limit the impact of successful exploitation

# Example: Restrict access to vulnerable endpoint in Apache
<Location "/application/websocket/controller/Setting.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>