CVE-2024-1117: Openbi Openbi RCE Vulnerability

CVE-2024-1117 Overview

A critical code injection vulnerability has been identified in openBI, an open-source business intelligence platform. The vulnerability exists in the index function of the file /application/index/controller/Screen.php, where improper handling of the fileurl argument allows attackers to inject and execute arbitrary code. This remote code execution vulnerability can be exploited without authentication, potentially allowing complete system compromise.

Critical Impact

Remote attackers can exploit this code injection vulnerability to execute arbitrary commands on vulnerable openBI installations, potentially leading to complete system compromise, data theft, and lateral movement within affected networks.

Affected Products

• openBI versions up to and including 1.0.8
• Systems running the vulnerable /application/index/controller/Screen.php controller
• Any deployment exposing the openBI application to untrusted networks

Discovery Timeline

• 2024-01-31 - CVE-2024-1117 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1117

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw resides in the index function within the Screen controller component of openBI. When processing the fileurl parameter, the application fails to properly validate or sanitize user-supplied input before incorporating it into dynamically generated code. This lack of input validation creates a direct pathway for code injection attacks.

The vulnerability allows remote attackers to craft malicious requests containing arbitrary code payloads in the fileurl parameter. When processed by the vulnerable function, this injected code is executed with the privileges of the web application, potentially providing attackers with full control over the underlying system.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and validation in the Screen controller's index function. The fileurl parameter is processed without adequate security controls, allowing malicious code to be injected and executed. This represents a fundamental secure coding failure where user-controllable input is used in code generation or execution contexts without proper escaping or validation.

Attack Vector

The attack can be launched remotely over the network without requiring any authentication or user interaction. An attacker can send specially crafted HTTP requests to the vulnerable endpoint, manipulating the fileurl parameter to inject malicious code. The exploit has been publicly disclosed, increasing the risk of active exploitation in the wild.

The attack flow involves:

1. Identifying an exposed openBI installation running a vulnerable version
2. Crafting a malicious request targeting /application/index/controller/Screen.php
3. Injecting code through the fileurl parameter
4. Achieving arbitrary code execution on the target server

Technical details of this vulnerability have been documented in Zhao's Security Note and VulDB #252475.

Detection Methods for CVE-2024-1117

Indicators of Compromise

• Unusual HTTP requests targeting /application/index/controller/Screen.php with suspicious fileurl parameter values
• Web server logs showing requests with encoded or obfuscated payloads in the fileurl parameter
• Unexpected process execution or network connections originating from the web server process
• Modified files or new unauthorized files appearing in the openBI installation directory

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block code injection patterns in the fileurl parameter
• Monitor web server access logs for requests to the Screen controller with abnormal parameter values
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process spawning from web application contexts
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities such as unauthorized command execution

Monitoring Recommendations

• Enable detailed logging for all requests to openBI controller endpoints
• Configure alerting for any requests containing code injection patterns or suspicious characters in URL parameters
• Monitor for unusual outbound network connections from hosts running openBI
• Track file system changes in the openBI installation directory for signs of web shell deployment

How to Mitigate CVE-2024-1117

Immediate Actions Required

• Upgrade openBI to a version newer than 1.0.8 if a patched version is available
• Restrict network access to openBI installations to trusted networks only
• Implement web application firewall rules to filter malicious fileurl parameter values
• Review web server logs for any evidence of exploitation attempts

Patch Information

No official vendor advisory or patch information was available at the time of publication. Organizations should monitor the openBI project for security updates and apply patches as soon as they become available. In the interim, implementing the recommended workarounds and network restrictions is strongly advised.

For additional context and technical details, refer to:

• VulDB CTI ID #252475
• VulDB #252475

Workarounds

• Restrict access to the Screen controller endpoint using web server access controls or firewall rules
• Implement input validation at the web server or reverse proxy level to sanitize the fileurl parameter
• Consider disabling or removing the vulnerable Screen controller functionality if not required
• Deploy a web application firewall with rules specifically targeting code injection attacks

# Example: Restrict access to vulnerable endpoint using Apache .htaccess
<Files "Screen.php">
    Order Deny,Allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Files>