CVE-2024-21855: Mayuresh82 Gocast RCE Vulnerability

CVE-2024-21855 Overview

A critical lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. This security flaw allows attackers to execute arbitrary commands on vulnerable systems through specially crafted HTTP requests without requiring any authentication. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), representing a fundamental security design flaw in the application's API implementation.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary command execution on systems running vulnerable GoCast installations, potentially leading to complete system compromise.

Affected Products

• GoCast version 1.1.3
• mayuresh82 gocast (cpe:2.3:a:mayuresh82:gocast:1.1.3:*:*:*:*:*:*:*)

Discovery Timeline

• 2024-11-21 - CVE-2024-21855 published to NVD
• 2024-12-20 - Last updated in NVD database

Technical Details for CVE-2024-21855

Vulnerability Analysis

This vulnerability represents a severe authentication bypass in GoCast's HTTP API implementation. GoCast is a BGP anycast routing daemon, and the vulnerable component is its HTTP-based management API. The core issue is that critical API endpoints that enable command execution are exposed without requiring any form of authentication.

An attacker with network access to the GoCast HTTP API can send specially crafted requests to execute arbitrary commands with the privileges of the GoCast process. This type of vulnerability is particularly dangerous in network infrastructure software as it could allow attackers to manipulate routing configurations, pivot to other network segments, or establish persistent access to the compromised system.

Root Cause

The root cause is the absence of authentication mechanisms protecting the HTTP API endpoints in GoCast 1.1.3. The application fails to verify the identity of requesters before processing potentially dangerous API calls. This design flaw exposes command execution functionality to any network-accessible attacker, violating fundamental security principles around access control for sensitive operations.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the GoCast HTTP API endpoint. The exploitation is straightforward due to the complete absence of authentication requirements:

1. Attacker identifies a GoCast 1.1.3 instance with an exposed HTTP API
2. Attacker crafts malicious HTTP requests targeting the vulnerable API endpoints
3. The server processes the request without authentication verification
4. Arbitrary commands are executed on the target system

The vulnerability does not require user interaction and can be exploited remotely with low attack complexity. Technical details and additional information are available in the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2024-21855

Indicators of Compromise

• Unexpected HTTP requests to the GoCast API endpoints from unauthorized IP addresses
• Anomalous process spawning from the GoCast daemon process
• Unusual network connections originating from the GoCast service
• System commands or shell activity correlated with GoCast API access logs

Detection Strategies

• Implement network monitoring to detect unauthorized access attempts to GoCast HTTP API ports
• Deploy intrusion detection signatures targeting exploitation patterns for unauthenticated API command execution
• Monitor GoCast process behavior for child process creation that may indicate command injection
• Review web server and application logs for suspicious API request patterns

Monitoring Recommendations

• Enable detailed logging for all HTTP API requests to GoCast
• Configure alerting for API requests originating from untrusted network segments
• Implement file integrity monitoring on systems running GoCast
• Monitor for process execution chains that originate from the GoCast daemon

How to Mitigate CVE-2024-21855

Immediate Actions Required

• Restrict network access to the GoCast HTTP API using firewall rules to allow only trusted management hosts
• Place GoCast instances behind a reverse proxy that enforces authentication
• Isolate GoCast deployments in dedicated management network segments
• Audit existing GoCast installations to identify exposed instances

Patch Information

Users should check the GoCast repository for updated versions that address this vulnerability. As no specific vendor advisory or patch information was available at the time of publication, organizations should monitor the official GoCast project for security updates. In the interim, applying network-level access controls is essential to reduce the attack surface.

Workarounds

• Implement network segmentation to restrict API access to trusted management hosts only
• Deploy a reverse proxy with authentication in front of the GoCast HTTP API
• Use host-based firewall rules (iptables, nftables) to limit connections to the API port
• Consider disabling the HTTP API entirely if not required for operations

# Example: Restrict GoCast API access using iptables
# Allow only management network (10.0.0.0/24) to access GoCast API port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP