CVE-2024-50715: Smart Agent RCE Vulnerability

CVE-2024-50715 Overview

CVE-2024-50715 is a command injection vulnerability affecting Smarts-srl Smart Agent version 1.1.0. The flaw resides in the /youtubeInfo.php component, which fails to sanitize a user-controlled parameter before passing it to a system command. A remote unauthenticated attacker can exploit this weakness over the network to disclose sensitive information from the host. The issue is categorized under [CWE-94] Improper Control of Generation of Code (Code Injection). Both the Pro and QoE editions of Smart Agent 1.1.0 are affected.

Critical Impact
Unauthenticated remote attackers can inject operating system commands through /youtubeInfo.php to read sensitive data from the underlying host.

Affected Products

Smarts-srl Smart Agent 1.1.0 (Pro edition)
Smarts-srl Smart Agent 1.1.0 (QoE edition)
/youtubeInfo.php component

Discovery Timeline

2024-12-27 - CVE-2024-50715 published to NVD
2025-04-21 - Last updated in NVD database

Technical Details for CVE-2024-50715

Vulnerability Analysis

The vulnerability exists in the /youtubeInfo.php endpoint shipped with Smart Agent 1.1.0. The script accepts a request parameter and passes it to a shell command without input validation or escaping. An attacker can append shell metacharacters such as ;, |, or backticks to execute arbitrary commands in the application's process context. Successful exploitation allows the attacker to read sensitive files, environment variables, or configuration data accessible to the web server account. The vulnerability requires no authentication and no user interaction, making it reachable by any network-adjacent attacker.

Root Cause

The root cause is improper neutralization of special elements used in an OS command, mapped to [CWE-94]. The /youtubeInfo.php handler concatenates an unsanitized HTTP parameter directly into a shell invocation. Because no allowlist, escaping function, or parameterized API is used, attacker-supplied content is interpreted by the shell.

Attack Vector

Exploitation occurs entirely over the network against the HTTP service exposing /youtubeInfo.php. An attacker submits a crafted request containing shell metacharacters in the vulnerable parameter. The command output, or its observable side effects, can be used to exfiltrate sensitive information from the host. Additional detail is available in the Packet Storm Security advisory.

No verified proof-of-concept code is published in the enriched dataset. Refer to the Packet Storm Security file for technical reproduction details.

Detection Methods for CVE-2024-50715

Indicators of Compromise

HTTP requests to /youtubeInfo.php containing shell metacharacters such as ;, |, &, $(, or backticks in query parameters.
Unexpected child processes spawned by the web server user, including sh, bash, cat, id, whoami, or curl.
Outbound connections initiated by the Smart Agent process to attacker-controlled hosts shortly after requests to /youtubeInfo.php.

Detection Strategies

Inspect web server access logs for anomalous query strings targeting /youtubeInfo.php, especially URL-encoded shell characters.
Deploy web application firewall rules that block command injection payload patterns on the YouTube info endpoint.
Correlate process execution telemetry with HTTP request logs to identify command spawning chained from the PHP handler.

Monitoring Recommendations

Continuously monitor process lineage on hosts running Smart Agent for shell processes parented by PHP-FPM or Apache.
Alert on read access to sensitive files such as /etc/passwd, /etc/shadow, or application configuration files by the web server account.
Track egress network connections from Smart Agent hosts to non-business destinations.

How to Mitigate CVE-2024-50715

Immediate Actions Required

Restrict network exposure of Smart Agent 1.1.0 management interfaces to trusted administrative networks only.
Block external access to /youtubeInfo.php at the perimeter or reverse proxy until a vendor patch is applied.
Audit web server and application logs for prior exploitation attempts referencing the vulnerable endpoint.

Patch Information

No vendor advisory or fixed version is referenced in the enriched CVE data. Operators should contact Smarts-srl directly for a patched build and monitor the vendor site for updates.

Workarounds

Place Smart Agent behind a web application firewall configured to filter shell metacharacters in request parameters.
Apply reverse proxy ACLs that deny access to /youtubeInfo.php from untrusted networks.
Run the Smart Agent service under a least-privileged account to limit the data accessible through command injection.

bash

# Example nginx configuration to deny external access to the vulnerable endpoint
location = /youtubeInfo.php {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}