CVE-2024-55062: Easyvirt Co2scope RCE Vulnerability

CVE-2024-55062 Overview

CVE-2024-55062 is a critical code injection vulnerability affecting EasyVirt DCScope versions 8.6.0 and below, as well as CO2Scope versions 1.3.0 and below. This vulnerability allows remote unauthenticated attackers to execute arbitrary code via the /api/license/sendlicense/ endpoint, posing a severe risk to organizations using these virtualization management and carbon footprint monitoring solutions.

Critical Impact

Remote unauthenticated attackers can achieve arbitrary code execution on vulnerable EasyVirt DCScope and CO2Scope installations, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• EasyVirt DCScope versions ≤ 8.6.0
• EasyVirt CO2Scope versions ≤ 1.3.0

Discovery Timeline

• 2025-01-31 - CVE-2024-55062 published to NVD
• 2025-05-24 - Last updated in NVD database

Technical Details for CVE-2024-55062

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), which occurs when an application constructs all or part of a command using externally-influenced input from an upstream component but does not properly neutralize special elements that could modify the intended command.

The vulnerable endpoint /api/license/sendlicense/ fails to properly validate and sanitize user-supplied input before incorporating it into system commands. Because this endpoint does not require authentication, any remote attacker with network access to the application can exploit this vulnerability without needing valid credentials.

The impact of successful exploitation is severe—attackers can execute arbitrary code with the privileges of the application, potentially leading to full system compromise, data exfiltration, installation of persistent backdoors, or using the compromised system as a pivot point for further attacks within the network.

Root Cause

The root cause of CVE-2024-55062 is improper input validation and sanitization in the license processing functionality. The /api/license/sendlicense/ API endpoint accepts user-controlled data that is subsequently passed to system command execution functions without adequate filtering of dangerous characters or command separators. This allows attackers to inject arbitrary commands that will be executed by the underlying operating system.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker targets the vulnerable /api/license/sendlicense/ endpoint by crafting a malicious request containing injected commands. When the application processes this request, it inadvertently executes the attacker's commands on the underlying system.

The attack flow typically involves:

1. Identifying an exposed EasyVirt DCScope or CO2Scope instance
2. Sending a crafted HTTP request to the /api/license/sendlicense/ endpoint
3. Including malicious command injection payloads within the license data parameters
4. The server processes the request and executes the injected commands with application privileges

For technical details and proof-of-concept information, refer to the GitHub PoC Repository.

Detection Methods for CVE-2024-55062

Indicators of Compromise

• Unusual HTTP POST requests to /api/license/sendlicense/ containing shell metacharacters or command sequences
• Unexpected process spawns originating from the EasyVirt application process
• New or modified files in system directories or web application paths
• Outbound network connections from the EasyVirt server to unknown external hosts
• Evidence of command execution in application logs (semicolons, pipes, backticks in license data)

Detection Strategies

• Monitor web application logs for suspicious requests to the /api/license/sendlicense/ endpoint containing shell metacharacters such as ;, |, $(), or backticks
• Implement network intrusion detection rules to identify exploitation attempts targeting this specific endpoint
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution chains originating from the EasyVirt application
• Audit authentication logs and access patterns for the license API endpoint

Monitoring Recommendations

• Enable detailed logging for all API endpoints, particularly /api/license/sendlicense/
• Configure SIEM alerts for patterns consistent with command injection attempts in HTTP request bodies
• Monitor process creation events on servers running EasyVirt products for unexpected child processes
• Implement file integrity monitoring on critical system directories and application paths

How to Mitigate CVE-2024-55062

Immediate Actions Required

• Restrict network access to EasyVirt DCScope and CO2Scope administrative interfaces to trusted IP addresses only
• Place vulnerable instances behind a web application firewall (WAF) configured to block command injection patterns
• If possible, disable or block access to the /api/license/sendlicense/ endpoint until a patch is applied
• Audit system logs for any evidence of prior exploitation attempts
• Consider taking vulnerable systems offline if they are internet-facing and cannot be adequately protected

Patch Information

Organizations should contact EasyVirt directly for information about security patches addressing this vulnerability. No vendor advisory URLs were available at the time of publication. Upgrade EasyVirt DCScope to versions greater than 8.6.0 and CO2Scope to versions greater than 1.3.0 when patches become available.

Workarounds

• Implement network segmentation to limit access to the vulnerable API endpoint to trusted internal networks only
• Deploy a reverse proxy or WAF in front of the application to filter malicious requests targeting /api/license/sendlicense/
• Disable the license API endpoint if it is not operationally required
• Monitor for exploitation attempts while awaiting an official patch

# Example: Block access to vulnerable endpoint using iptables
# Restrict access to EasyVirt application port from untrusted networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP