CVE-2024-58275: Easywall Command Injection RCE Vulnerability

CVE-2024-58275 Overview

CVE-2024-58275 is a command injection vulnerability in Easywall version 0.3.1, an open-source web interface for managing iptables firewall rules. The flaw resides in the /ports-save endpoint, which fails to sanitize user-supplied port parameters before passing them to a shell context. Authenticated attackers can inject shell metacharacters into the affected parameter to execute arbitrary operating system commands with the privileges of the Easywall service. Because Easywall typically runs with elevated privileges to manage firewall rules, exploitation often results in full server compromise.

Critical Impact
An authenticated attacker can achieve remote code execution on the underlying host through parameter injection in the port configuration endpoint, undermining both the firewall and the system it protects.

Affected Products

Easywall 0.3.1
Deployments referenced in the Easywall GitHub repository
Installations following the Easywall documentation site

Discovery Timeline

2025-12-04 - CVE-2024-58275 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-58275

Vulnerability Analysis

Easywall provides a Python-based web front end that lets administrators configure iptables rules, including open TCP and UDP ports. The /ports-save endpoint accepts port values submitted through the web interface and persists them to the firewall configuration. Instead of validating that each value is a numeric port or a well-formed port range, the endpoint incorporates the raw input into a shell command executed on the host.

Because the input crosses into a shell context without sanitization, attackers can supply metacharacters such as ;, |, &&, or backticks to break out of the intended command and append arbitrary payloads. The classification maps to argument injection [CWE-88], where attacker-controlled data alters the composition of an executed command line. Exploitation requires valid authentication to Easywall, but any account able to reach the ports configuration page can trigger the flaw.

Root Cause

The root cause is the absence of input validation and safe process invocation on the port parameter received by /ports-save. The application concatenates untrusted user input into a command string executed through a shell rather than passing arguments to subprocess as an argument list with shell=False. This design decision converts a configuration field into an execution primitive.

Attack Vector

An attacker authenticates to the Easywall web interface, then submits a crafted POST request to /ports-save in which a port field contains a shell metacharacter followed by an arbitrary command. When the backend processes the update, it executes the injected command with the privileges of the Easywall process. Public exploitation details are documented in Exploit-DB entry 51856 and the VulnCheck Easywall advisory.

No verified proof-of-concept code is reproduced here; refer to the linked advisories for exploitation payload details.

Detection Methods for CVE-2024-58275

Indicators of Compromise

Unexpected child processes spawned by the Easywall Python process, particularly shells such as /bin/sh, /bin/bash, or utilities like curl, wget, nc, or python.
POST requests to /ports-save containing shell metacharacters (;, |, &, `, $() in port parameters within Easywall access logs.
New or modified iptables rules that do not correspond to administrator activity, alongside outbound connections from the firewall host to unfamiliar destinations.

Detection Strategies

Alert on process-lineage anomalies where the Easywall web server spawns interactive shells or network utilities not required for firewall management.
Deploy web server request inspection to flag non-numeric characters in port fields submitted to /ports-save.
Correlate authentication events for the Easywall interface with subsequent process creation on the host to identify post-authentication abuse.

Monitoring Recommendations

Forward Easywall application logs, auth.log, and iptables change events to a centralized logging platform for retention and analysis.
Baseline the normal process tree of the Easywall service and alert on deviations, especially child processes executing shell commands.
Monitor outbound network connections from the firewall host, which should typically be limited to management and package update traffic.

How to Mitigate CVE-2024-58275

Immediate Actions Required

Restrict network access to the Easywall management interface to trusted administrative networks or a VPN, eliminating exposure to untrusted networks.
Rotate all Easywall user credentials and audit accounts for unauthorized additions or role changes.
Review recent /ports-save requests and host process history for signs of exploitation, and rebuild the host from a known-good image if compromise is suspected.

Patch Information

No vendor-issued patch is referenced in the NVD record for CVE-2024-58275 at the time of publication. Administrators should track updates in the Easywall GitHub repository and apply fixes as soon as they are released. Until a fixed release is available, treat Easywall 0.3.1 as vulnerable and apply compensating controls.

Workarounds

Take the Easywall web interface offline and manage firewall rules directly via iptables or configuration management tooling until a patched release is available.
Place the interface behind a reverse proxy that enforces strict allowlists on request bodies, rejecting any port parameter that is not a numeric value or numeric range.
Run the Easywall service under a dedicated low-privilege account with narrowly scoped sudo rules limited to specific iptables commands, reducing the impact of successful command injection.

bash

# Example nginx location block restricting access to trusted admins
location /ports-save {
    allow 10.0.0.0/24;   # admin management network
    deny all;
    proxy_pass http://127.0.0.1:12227;
}