CVE-2024-8504: VICIdial Agent RCE Vulnerability

CVE-2024-8504 Overview

CVE-2024-8504 is an OS command injection vulnerability in VICIdial, an open-source contact center suite. An authenticated user with the agent role can execute arbitrary shell commands as the root user. The flaw maps to CWE-78, improper neutralization of special elements used in an operating system command. Attackers can chain this vulnerability with CVE-2024-8503 to achieve unauthenticated remote code execution against a VICIdial instance. The Exploit Prediction Scoring System (EPSS) rates this issue at 76.217%, placing it in the 99.494 percentile of exploitation likelihood.

Critical Impact
A low-privileged agent account can escalate to full root-level shell access on the underlying host, resulting in complete system compromise.

Affected Products

VICIdial contact center suite (see ViciDial Official Resource)
Deployments exposing the agent web interface to authenticated users
Environments where the VICIdial web application executes with root privileges

Discovery Timeline

2024-09-10 - CVE-2024-8504 published to the National Vulnerability Database (NVD)
2024-09 - Advisory released via the Full Disclosure Mailing List and KoreLogic Security Advisory KL-001-2024-012
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-8504

Vulnerability Analysis

The vulnerability is a command injection flaw reachable by any authenticated VICIdial user assigned the agent role. The application passes user-controlled input into a shell context without sufficient sanitization. Because the VICIdial web tier executes with root privileges, injected commands run as root. This yields immediate and total control of the underlying host operating system.

The attack vector is network-based with low complexity and requires only low privileges. No user interaction is needed. Chaining CVE-2024-8504 with CVE-2024-8503, an authentication or agent-provisioning weakness, extends the attack surface to unauthenticated actors. The combined chain converts a remote pre-auth foothold into arbitrary root command execution.

Root Cause

The root cause is improper neutralization of special characters passed to an operating system command [CWE-78]. VICIdial constructs shell command strings that incorporate parameters supplied through agent-facing HTTP endpoints. Metacharacters such as backticks, semicolons, and shell substitution sequences are not stripped or escaped before execution. Refer to the KoreLogic advisory for the specific vulnerable endpoints and parameter names.

Attack Vector

An attacker authenticates to the VICIdial agent interface using valid credentials or a chained bypass through CVE-2024-8503. The attacker then sends a crafted HTTP request containing shell metacharacters in a vulnerable parameter. The VICIdial backend concatenates the input into a shell invocation and executes it as root. The result is arbitrary command execution with full privileges, enabling credential theft, persistence installation, lateral movement, and data exfiltration.

No verified public proof-of-concept code is referenced in the enriched data. See the KoreLogic advisory for exploitation specifics.

Detection Methods for CVE-2024-8504

Indicators of Compromise

Unexpected child processes spawned by the Apache or web-server user running as root, particularly shells such as /bin/sh, /bin/bash, nc, curl, wget, or python.
HTTP POST or GET requests to VICIdial agent endpoints containing shell metacharacters (;, |, `, $(, &&) in query string or body parameters.
New cron jobs, systemd units, or SSH authorized keys created shortly after agent authentication events.

Detection Strategies

Inspect web server access logs for anomalous parameter values on VICIdial agent PHP endpoints, correlating on encoded shell operators.
Monitor process creation telemetry for command interpreters whose parent process is the VICIdial web server.
Alert on outbound network connections initiated by the VICIdial host to previously unseen external IP addresses.

Monitoring Recommendations

Enable verbose HTTP request logging on VICIdial front ends and forward the logs to a centralized analytics platform.
Baseline normal agent traffic patterns and flag deviations in request length, parameter entropy, and endpoint frequency.
Track privileged process trees and file writes to sensitive locations such as /etc/passwd, /etc/shadow, /root/.ssh/, and cron directories.

How to Mitigate CVE-2024-8504

Immediate Actions Required

Restrict network access to the VICIdial agent interface to trusted management networks or VPN users only.
Rotate all agent, administrator, and system credentials on affected VICIdial installations.
Audit the VICIdial host for signs of prior exploitation, including unauthorized users, cron entries, and outbound connections.
Reduce the privileges of the VICIdial web tier so it does not run as root where operationally feasible.

Patch Information

Apply the latest VICIdial updates published after September 2024 that address the command injection issues documented in KoreLogic KL-001-2024-012. Because CVE-2024-8504 can be chained with CVE-2024-8503, both vulnerabilities must be remediated together to prevent unauthenticated exploitation. Consult the vendor at vicidial.org for current release notes and SVN revisions.

Workarounds

Place a web application firewall (WAF) in front of VICIdial and block requests containing shell metacharacters in agent parameters.
Enforce strict role-based access control and disable unused agent accounts to shrink the exploitable population.
Segment the VICIdial server on an isolated VLAN with egress filtering to limit post-exploitation impact.

bash

# Example WAF rule concept (ModSecurity) to block shell metacharacters
# in VICIdial agent request parameters
SecRule REQUEST_URI "@beginsWith /agc/" \
    "chain,phase:2,deny,status:403,id:1008504,\
    msg:'CVE-2024-8504 possible command injection'"
    SecRule ARGS "@rx (?:[;|&\\x60]|\$\(|\|\||&&)" \
        "t:none,t:urlDecodeUni"