CVE-2024-5407: Saltos RhinOS RCE Vulnerability

CVE-2024-5407 Overview

A PHP code injection vulnerability exists in RhinOS 3.0-1190 that allows remote attackers to inject and execute arbitrary PHP code through the "search" parameter in the /portal/search.htm endpoint. This vulnerability enables attackers to establish a reverse shell on the affected system, potentially compromising the entire infrastructure without requiring authentication.

Critical Impact
This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected RhinOS systems, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network infrastructure.

Affected Products

Saltos RhinOS 3.0-1190

Discovery Timeline

2024-05-27 - CVE-2024-5407 published to NVD
2025-06-05 - Last updated in NVD database

Technical Details for CVE-2024-5407

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw resides in the search functionality of the RhinOS web portal, where user-supplied input through the "search" parameter is not properly sanitized before being processed by the PHP interpreter.

The vulnerability allows attackers to inject malicious PHP code that is subsequently executed on the server with the privileges of the web server process. Since the attack requires no authentication and can be performed remotely over the network, it presents a significant risk to organizations running vulnerable RhinOS installations.

Successful exploitation enables attackers to establish interactive reverse shells, giving them full command execution capabilities on the target system. This can lead to complete infrastructure compromise, including access to sensitive data, configuration files, and the ability to pivot to other systems within the network.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization of the "search" parameter in /portal/search.htm. The application fails to adequately filter or escape user-supplied input before incorporating it into PHP code execution contexts. This allows specially crafted input containing PHP code fragments to be interpreted and executed by the server's PHP engine.

Attack Vector

The attack is network-based and requires no prior authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the /portal/search.htm endpoint with malicious PHP code embedded in the "search" parameter. The injected code is then executed server-side, allowing the attacker to run arbitrary commands, establish reverse shells, or perform other malicious actions.

The exploitation flow typically involves:

Identifying a vulnerable RhinOS installation accessible over the network
Crafting a malicious HTTP request with PHP code in the "search" parameter
Sending the request to the target server's /portal/search.htm endpoint
The PHP code executes on the server, establishing a reverse shell or executing attacker-controlled commands

For technical details on the vulnerability mechanism, refer to the INCIBE Security Notice and the GitHub RhinOS Repository.

Detection Methods for CVE-2024-5407

Indicators of Compromise

Suspicious HTTP requests to /portal/search.htm containing PHP function calls or shell commands in the search parameter
Unexpected outbound network connections from the web server to unknown external hosts
Unusual process spawning from the web server process (e.g., /bin/sh, /bin/bash, nc, python)
New or modified files in web-accessible directories with executable content
Anomalous web server log entries showing encoded or obfuscated payloads in search requests

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block PHP code injection patterns in HTTP parameters
Implement intrusion detection system (IDS) signatures for common reverse shell patterns and PHP injection payloads
Monitor web server access logs for suspicious requests containing PHP function names such as eval(), exec(), system(), passthru(), or shell_exec()
Configure endpoint detection and response (EDR) solutions to alert on unexpected child processes spawned by web server processes

Monitoring Recommendations

Enable verbose logging on the RhinOS web application and centralize logs for analysis
Implement network traffic analysis to detect reverse shell communications (unusual outbound connections on non-standard ports)
Set up file integrity monitoring for web application directories to detect unauthorized modifications
Monitor for abnormal CPU or memory usage patterns that may indicate cryptominer deployment post-exploitation

How to Mitigate CVE-2024-5407

Immediate Actions Required

Restrict network access to the RhinOS portal to trusted IP addresses only using firewall rules
Consider temporarily disabling the search functionality in /portal/search.htm if not critical to operations
Implement a Web Application Firewall (WAF) with rules to block PHP code injection attempts
Review web server logs for signs of prior exploitation attempts
If compromise is suspected, isolate the affected system and perform forensic analysis

Patch Information

Review the INCIBE Security Notice for official remediation guidance. Check the GitHub RhinOS Repository for updates and security patches from Saltos. Ensure your RhinOS installation is updated to the latest available version that addresses this vulnerability.

Workarounds

Deploy a reverse proxy with strict input validation to filter potentially malicious requests before they reach the RhinOS application
Implement application-level input sanitization for the search parameter using allowlisting for permitted characters
Use network segmentation to isolate RhinOS systems from critical infrastructure
Disable or restrict access to the /portal/search.htm endpoint through web server configuration until a patch is available

bash

# Example: Block access to vulnerable endpoint using Apache .htaccess
<Location "/portal/search.htm">
    Order Deny,Allow
    Deny from all
    # Allow from trusted networks only
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Location>