CVE-2024-58287: Yogeshojha Rengine RCE Vulnerability

CVE-2024-58287 Overview

CVE-2024-58287 is an authenticated command injection vulnerability in reNgine 2.2.0, an open-source automated reconnaissance framework maintained by yogeshojha. The flaw resides in the nmap_cmd parameter of the scan engine configuration, where user-supplied input is passed to an underlying shell context without proper sanitization. Authenticated attackers can submit malicious base64-encoded payloads through the scan engine configuration to achieve remote code execution on the host running reNgine. The weakness is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated attackers can execute arbitrary operating system commands on the reNgine host, leading to full compromise of the reconnaissance platform and any data or credentials it stores.

Affected Products

yogeshojha reNgine 2.2.0
reNgine scan engine configuration component
Deployments exposing the reNgine web interface to authenticated users

Discovery Timeline

2025-12-11 - CVE-2024-58287 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-58287

Vulnerability Analysis

reNgine allows users to define scan engine configurations that include an nmap_cmd field. This value is later consumed and executed by the backend as part of an nmap scan invocation. The application does not adequately validate or neutralize shell metacharacters supplied through this parameter. Attackers can chain arbitrary commands into the executed process by embedding them in the field, including base64-encoded payloads that are decoded and executed at runtime.

Because reNgine typically runs inside container workloads with broad network access and stored API keys for downstream services, code execution on the reconnaissance host expands into lateral movement risk. Exposed secrets, target data, and scan results all become accessible to the attacker.

Root Cause

The root cause is unsafe construction of a shell command string from attacker-controlled configuration input. The scan engine configuration accepts the nmap_cmd value from the authenticated user and forwards it to a shell interpreter without argument-level separation or allowlisting. This design pattern maps directly to [CWE-78].

Attack Vector

An attacker requires valid authenticated access to the reNgine web application. The attacker edits or creates a scan engine configuration and injects shell metacharacters or a base64-encoded command sequence into the nmap_cmd parameter. When a scan referencing that configuration runs, the injected commands execute with the privileges of the reNgine scanning service. See the VulnCheck Security Advisory and Exploit-DB #52081 for the technical write-up and proof-of-concept.

No verified public exploit code is reproduced here. Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2024-58287

Indicators of Compromise

Unexpected child processes of the reNgine scan worker, such as sh, bash, curl, wget, or python, spawned from an nmap invocation context.
Scan engine configuration records containing shell metacharacters (;, |, &&, backticks) or base64 -d sequences in the nmap_cmd field.
Outbound network connections from the reNgine container to unfamiliar IP addresses shortly after a scan configuration is saved or executed.
New or modified files in writable directories of the reNgine container that do not correspond to expected scan output.

Detection Strategies

Inspect the reNgine database and configuration exports for nmap_cmd values that deviate from the documented nmap flag syntax.
Correlate web application audit logs of scan engine edits with subsequent process execution telemetry on the reNgine host.
Alert on nmap process trees that fork non-scanner binaries or write to unexpected paths.

Monitoring Recommendations

Enable process-level auditing on the reNgine host or container runtime and forward events to a centralized log store.
Monitor egress traffic from reNgine workers for connections to non-target destinations, including known paste sites and command-and-control infrastructure.
Track authentication and privilege changes within the reNgine application, focusing on accounts able to modify scan engines.

How to Mitigate CVE-2024-58287

Immediate Actions Required

Restrict network access to the reNgine web interface so that only trusted operators can reach it, ideally behind a VPN or reverse proxy with strong authentication.
Rotate all credentials, API tokens, and SSH keys stored in reNgine if the platform has been reachable by untrusted authenticated users.
Audit existing scan engine configurations for injected commands in the nmap_cmd field and remove any suspicious entries.
Review reNgine user accounts, disable unused accounts, and enforce strong, unique passwords for all remaining users.

Patch Information

At the time of publication, the enriched CVE data does not list a fixed version. Track the reNgine GitHub repository and the reNgine documentation for updated releases that address the nmap_cmd command injection. Until a patched release is confirmed, treat reNgine 2.2.0 deployments as vulnerable.

Workarounds

Limit scan engine configuration privileges to a minimal set of trusted administrators.
Run reNgine in an isolated network segment with strict egress filtering to reduce the blast radius of code execution.
Deploy reNgine inside a hardened container with a read-only root filesystem and non-root user where feasible.
Place a web application firewall or reverse proxy in front of reNgine to log and inspect scan engine configuration submissions.

bash

# Example: restrict reNgine container egress with an iptables allowlist
# Replace <SCAN_TARGET_CIDR> with the specific networks reNgine is authorized to scan
iptables -I DOCKER-USER -s <RENGINE_CONTAINER_IP> -d <SCAN_TARGET_CIDR> -j ACCEPT
iptables -I DOCKER-USER -s <RENGINE_CONTAINER_IP> -j DROP