CVE-2024-55062: Easyvirt Co2scope RCE Vulnerability

CVE-2024-55062 Overview

CVE-2024-55062 is a critical code injection vulnerability affecting EasyVirt DCScope versions 8.6.0 and below, as well as CO2Scope versions 1.3.0 and below. This vulnerability allows remote unauthenticated attackers to execute arbitrary code via the /api/license/sendlicense/ endpoint, posing a severe risk to organizations using these virtualization management and carbon footprint monitoring solutions.

Critical Impact
Remote unauthenticated attackers can achieve arbitrary code execution on vulnerable EasyVirt DCScope and CO2Scope installations, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

EasyVirt DCScope versions ≤ 8.6.0
EasyVirt CO2Scope versions ≤ 1.3.0

Discovery Timeline

2025-01-31 - CVE-2024-55062 published to NVD
2025-05-24 - Last updated in NVD database

Technical Details for CVE-2024-55062

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), which occurs when an application constructs all or part of a command using externally-influenced input from an upstream component but does not properly neutralize special elements that could modify the intended command.

The vulnerable endpoint /api/license/sendlicense/ fails to properly validate and sanitize user-supplied input before incorporating it into system commands. Because this endpoint does not require authentication, any remote attacker with network access to the application can exploit this vulnerability without needing valid credentials.

The impact of successful exploitation is severe—attackers can execute arbitrary code with the privileges of the application, potentially leading to full system compromise, data exfiltration, installation of persistent backdoors, or using the compromised system as a pivot point for further attacks within the network.

Root Cause

The root cause of CVE-2024-55062 is improper input validation and sanitization in the license processing functionality. The /api/license/sendlicense/ API endpoint accepts user-controlled data that is subsequently passed to system command execution functions without adequate filtering of dangerous characters or command separators. This allows attackers to inject arbitrary commands that will be executed by the underlying operating system.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker targets the vulnerable /api/license/sendlicense/ endpoint by crafting a malicious request containing injected commands. When the application processes this request, it inadvertently executes the attacker's commands on the underlying system.

The attack flow typically involves:

Identifying an exposed EasyVirt DCScope or CO2Scope instance
Sending a crafted HTTP request to the /api/license/sendlicense/ endpoint
Including malicious command injection payloads within the license data parameters
The server processes the request and executes the injected commands with application privileges

For technical details and proof-of-concept information, refer to the GitHub PoC Repository.

Detection Methods for CVE-2024-55062

Indicators of Compromise

Unusual HTTP POST requests to /api/license/sendlicense/ containing shell metacharacters or command sequences
Unexpected process spawns originating from the EasyVirt application process
New or modified files in system directories or web application paths
Outbound network connections from the EasyVirt server to unknown external hosts
Evidence of command execution in application logs (semicolons, pipes, backticks in license data)

Detection Strategies

Monitor web application logs for suspicious requests to the /api/license/sendlicense/ endpoint containing shell metacharacters such as ;, |, $(), or backticks
Implement network intrusion detection rules to identify exploitation attempts targeting this specific endpoint
Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution chains originating from the EasyVirt application
Audit authentication logs and access patterns for the license API endpoint

Monitoring Recommendations

Enable detailed logging for all API endpoints, particularly /api/license/sendlicense/
Configure SIEM alerts for patterns consistent with command injection attempts in HTTP request bodies
Monitor process creation events on servers running EasyVirt products for unexpected child processes
Implement file integrity monitoring on critical system directories and application paths

How to Mitigate CVE-2024-55062

Immediate Actions Required

Restrict network access to EasyVirt DCScope and CO2Scope administrative interfaces to trusted IP addresses only
Place vulnerable instances behind a web application firewall (WAF) configured to block command injection patterns
If possible, disable or block access to the /api/license/sendlicense/ endpoint until a patch is applied
Audit system logs for any evidence of prior exploitation attempts
Consider taking vulnerable systems offline if they are internet-facing and cannot be adequately protected

Patch Information

Organizations should contact EasyVirt directly for information about security patches addressing this vulnerability. No vendor advisory URLs were available at the time of publication. Upgrade EasyVirt DCScope to versions greater than 8.6.0 and CO2Scope to versions greater than 1.3.0 when patches become available.

Workarounds

Implement network segmentation to limit access to the vulnerable API endpoint to trusted internal networks only
Deploy a reverse proxy or WAF in front of the application to filter malicious requests targeting /api/license/sendlicense/
Disable the license API endpoint if it is not operationally required
Monitor for exploitation attempts while awaiting an official patch

bash

# Example: Block access to vulnerable endpoint using iptables
# Restrict access to EasyVirt application port from untrusted networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP