CVE-2024-39227: GL-iNet MT6000 Firmware RCE Vulnerability

CVE-2024-39227 Overview

CVE-2024-39227 is a critical vulnerability affecting multiple GL-iNet router products that allows unauthenticated attackers to execute arbitrary code or perform directory traversal attacks. The vulnerability exists in the /cgi-bin/glc endpoint, which was discovered to contain insecure permissions that fail to properly validate user authentication before processing requests. Attackers can exploit this flaw by sending crafted JSON data to the vulnerable endpoint, potentially gaining complete control over affected devices.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on vulnerable GL-iNet routers, potentially compromising entire network infrastructure without requiring any credentials.

Affected Products

• GL-iNet AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 firmware v4.3.11
• GL-iNet MT3000/MT2500/AXT1800/AX1800/A1300/X300B firmware v4.5.16
• GL-iNet XE300 firmware v4.3.16, E750 firmware v4.3.12, AP1300/S1300 firmware v4.3.13, XE3000/X3000 firmware v4.4
• GL-iNet MT6000 firmware v4.5.8
• GL-iNet B2200/MV1000/MV1000W/USB150/SF1200/N300/S1300 firmware v3.216

Discovery Timeline

• August 6, 2024 - CVE-2024-39227 published to NVD
• August 15, 2024 - Last updated in NVD database

Technical Details for CVE-2024-39227

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-75 (Failure to Sanitize Special Elements into a Different Plane). The /cgi-bin/glc endpoint in GL-iNet router firmware fails to implement proper authentication checks and input validation, allowing unauthenticated users to access sensitive functionality that should require administrative privileges.

The attack can be executed remotely over the network without user interaction, and successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected device. Given that these are network routers, compromise can lead to further attacks against all connected devices and network traffic interception.

Root Cause

The root cause of this vulnerability is the implementation of insecure permissions on the /cgi-bin/glc CGI endpoint. The endpoint processes incoming JSON data without first verifying that the request originates from an authenticated user session. This architectural flaw allows any network-accessible attacker to interact with privileged functionality intended only for authenticated administrators. Additionally, the endpoint lacks proper input sanitization, enabling injection attacks through maliciously crafted JSON payloads.

Attack Vector

The attack vector for CVE-2024-39227 involves sending specially crafted HTTP requests containing malicious JSON data to the /cgi-bin/glc endpoint on vulnerable GL-iNet routers. Since no authentication is required, attackers can directly access this endpoint from the network. The malicious JSON payload can be constructed to either:

1. Execute arbitrary commands on the underlying operating system, achieving remote code execution
2. Traverse directories to access sensitive files outside the intended scope

The vulnerability can be exploited by any attacker with network access to the router's web interface, including from the LAN side or potentially from the WAN side if remote management is enabled.

For technical details on the exploitation mechanism, refer to the GL-iNet CVE Issues repository.

Detection Methods for CVE-2024-39227

Indicators of Compromise

• Unexpected HTTP POST requests to /cgi-bin/glc endpoint from external or unauthorized IP addresses
• Unusual process execution on the router originating from CGI processes
• Modified configuration files or new files created in system directories
• Anomalous outbound network connections from the router to unknown destinations

Detection Strategies

• Monitor web server access logs for requests to /cgi-bin/glc with suspicious JSON payloads
• Implement network intrusion detection rules to alert on unauthenticated access attempts to GL-iNet router management interfaces
• Deploy behavioral analysis to detect unusual command execution patterns on embedded devices
• Use SentinelOne Singularity for network traffic analysis to identify exploitation attempts targeting IoT devices

Monitoring Recommendations

• Enable verbose logging on GL-iNet routers if supported and forward logs to a centralized SIEM
• Monitor network traffic for connections to the router's web management port (typically TCP 80 or 443)
• Implement network segmentation to restrict access to router management interfaces to trusted administrator hosts only

How to Mitigate CVE-2024-39227

Immediate Actions Required

• Update affected GL-iNet router firmware to the latest available version immediately
• Restrict network access to the router's web management interface using firewall rules
• Disable remote management features if not explicitly required
• Isolate affected devices on a separate network segment until patches can be applied

Patch Information

Organizations should check the GL-iNet official website and the GL-iNet CVE Issues repository for updated firmware releases that address this vulnerability. Given the critical nature of this flaw, firmware updates should be applied as the highest priority.

Workarounds

• Implement strict firewall rules to block external access to the router's web interface on ports 80 and 443
• Use VPN access for remote administration instead of exposing the management interface directly
• If possible, disable the /cgi-bin/glc endpoint through custom firewall rules on the router
• Monitor for and block suspicious JSON payloads at the network perimeter

# Example: Block external access to management interface using iptables
# (Apply on upstream firewall or gateway)
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP

# Allow only trusted management hosts
iptables -I FORWARD -s <ADMIN_IP> -d <ROUTER_IP> -p tcp --dport 443 -j ACCEPT