Mitigating CVE-2024-4504: Ruijie RG-UAC OS Command Injection Vulnerability

Understanding CVE-2024-4504

The CVE-2024-4504 is a critical vulnerability identified in Ruijie RG-UAC systems. Specifically, it affects the versions up to 20240428. Classified under CWE-78 OS Command Injection, this vulnerability is found in the file /view/HAconfig/baseConfig/commit.php. The loophole allows malicious actors to manipulate the peer_ip/local_ip argument, which can lead to OS command execution. Although the exploit is publicly available, Ruijie has yet to respond to the disclosure.

Impact and Severity

Several key metrics outline the severity of CVE-2024-4504:

• CVSSv3.1: Base score of 4.7 (Medium), with a vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
• CVSSv3.0: Base score of 4.7 (Medium), with a vector string CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
• CVSSv2.0: Base score of 5.8, with a vector string AV:N/AC:L/Au:M/C:P/I:P/A:P.

The vulnerability can be remotely exploited, leading to unauthorized command execution on the target system. This could significantly compromise the confidentiality, integrity, and availability of the affected systems.

Mitigation Strategies

Given the critical nature of CVE-2024-4504, it is crucial to undertake the following mitigation steps:

1. Update to Latest Version: Ensure Ruijie RG-UAC systems are updated to versions after 20240428. Regular updates from the vendor can mitigate such vulnerabilities.
2. Implement Network Segmentation: Isolate critical systems and restrict network access to limit potential attack vectors.
3. Input Validation: Implement proper input validation for web applications to prevent command injection via manipulated parameters.
4. Apply Patches: Monitor for patches from Ruijie or third-party advisories. Check resources like VulDB and GitHub for any available fixes or workaround patches.
5. Monitor Network Traffic: Employ intrusion detection systems to monitor and block suspicious activities related to command injections.

Conclusion

CVE-2024-4504 is a significant security concern for organizations using Ruijie RG-UAC systems. Prompt actions, including updating systems, applying patches, and implementing rigorous security measures, are essential to protect against potential exploits. Always stay updated with the latest advisories to ensure system security and integrity.