CVE-2024-22107 Overview
CVE-2024-22107 is a command injection vulnerability in GTB Central Console version 15.17.1-30814.NG. The flaw resides in the systemSettingsDnsDataAction method located at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php. Attackers reach the vulnerable code through the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker with high privileges can inject arbitrary operating system commands and fully compromise the platform. The vulnerability is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command).
Critical Impact
Successful exploitation grants arbitrary command execution on the underlying host, leading to complete compromise of the GTB Central Console data loss prevention platform.
Affected Products
- GTB Central Console 15.17.1-30814.NG
- Vendor: GTB Technologies (gttb)
- Component: SystemSettingsController.php — systemSettingsDnsDataAction
Discovery Timeline
- 2024-02-02 - CVE-2024-22107 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22107
Vulnerability Analysis
The vulnerability exists in the DNS settings handler exposed by the GTB Central Console web application. The systemSettingsDnsDataAction method processes user-supplied input from the /old/react/v1/api/system/dns/data endpoint and passes it to a system-level command without proper neutralization of shell metacharacters. Because the request handler executes commands in the context of the web application user, injected commands run with the privileges of that service account. The attacker must first authenticate to the console, which limits the attack surface to insiders or attackers who have already obtained valid credentials. Once authenticated, the attacker gains code execution on the appliance and can pivot to sensitive data managed by the DLP platform.
Root Cause
The root cause is missing sanitization of parameters supplied to a shell invocation inside systemSettingsDnsDataAction. Input intended to configure DNS values is concatenated into a command string that is executed by the operating system shell, allowing metacharacters such as ;, |, and backticks to break out of the intended command context.
Attack Vector
Exploitation requires network access to the management interface and a valid authenticated session with sufficient privileges. The attacker sends a crafted HTTP request to the /old/react/v1/api/system/dns/data endpoint containing shell metacharacters within the DNS configuration parameters. The injected payload executes on the appliance, returning results through side channels or establishing an interactive shell. Technical exploitation details are documented in the 0x Adepts research writeup.
Detection Methods for CVE-2024-22107
Indicators of Compromise
- Unexpected HTTP POST requests to /old/react/v1/api/system/dns/data containing shell metacharacters such as ;, |, &, or backticks in DNS parameter fields.
- Child processes spawned by the PHP-FPM or web server user that are unrelated to normal DNS configuration binaries (for example, bash, nc, curl, wget, or python).
- Outbound network connections from the GTB Central Console host to unfamiliar IP addresses shortly after configuration API activity.
Detection Strategies
- Review web server access logs for authenticated requests to the /old/react/v1/api path tree, correlating request bodies with subsequent process activity on the host.
- Deploy endpoint monitoring on the appliance to alert on process lineage where the web server parent spawns interactive shells or network utilities.
- Alert on modifications to /etc/resolv.conf or DNS-related files that occur outside of scheduled administrative windows.
Monitoring Recommendations
- Enable verbose audit logging on the GTB Central Console and forward logs to a centralized SIEM for retention and correlation.
- Monitor authentication events on the management console for anomalous login patterns, brute force attempts, or use of stale administrator accounts.
- Track outbound connectivity from the appliance and baseline expected destinations to detect command-and-control activity following exploitation.
How to Mitigate CVE-2024-22107
Immediate Actions Required
- Restrict network access to the GTB Central Console management interface to a dedicated administrative network or VPN.
- Rotate credentials for all accounts with access to the console and enforce strong, unique passwords with multi-factor authentication where supported.
- Audit administrative accounts and remove any unused or overprivileged users to reduce the number of principals who could reach the vulnerable endpoint.
- Contact GTB Technologies to confirm the latest available fixed version and apply the vendor-supplied update.
Patch Information
At the time of publication, no vendor advisory URL is listed in NVD. Administrators running GTB Central Console 15.17.1-30814.NG should contact GTB Technologies directly to obtain remediation guidance and any patched build. Additional technical context is available in the 0x Adepts blog post and the aggregated CVE listing.
Workarounds
- Block or filter requests to /old/react/v1/api/system/dns/data at an upstream reverse proxy or web application firewall until a vendor patch is applied.
- Limit console access to trusted source IP ranges using host or network firewall rules to reduce exposure of the authenticated endpoint.
- Remove administrative privileges from accounts that do not require system settings access, minimizing the population of users capable of triggering the vulnerable method.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
