Vulnerabilidade de Injeção de Código em RhinOS da SaltOS

The impact of CVE-2024-5407 is severe. An attacker exploiting this vulnerability can achieve remote code execution (RCE) on the affected RhinOS system. This means they can execute arbitrary commands with the privileges of the web server user, effectively gaining complete control over the system. This could lead to data theft, modification, or deletion, as well as the installation of malware or the use of the compromised system as a launchpad for further attacks against other systems on the network. The ability to execute a reverse shell is particularly concerning, as it allows the attacker to maintain persistent access to the system even after the initial exploit.

Organizations utilizing RhinOS in their industrial control systems or other critical infrastructure deployments are particularly at risk. Systems exposed directly to the internet without adequate security controls are also highly vulnerable. Shared hosting environments where multiple users share the same RhinOS instance could allow attackers to compromise multiple tenants through this vulnerability.

• linux / server:

journalctl -u php-fpm -g 'search.htm' | grep -i 'php://filter'

• generic web:

curl -I 'http://your-rhinos-server/portal/search.htm?search=php://filter/convert.foo.bar' | grep 'Content-Type' # Check for unexpected content types

1. 2024-05-27Disclosure

   disclosure

1. Reservado2024-05-27
2. Publicada2024-05-27
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-5407 is to immediately upgrade RhinOS to version 3.0.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious PHP code in the 'search' parameter. Input validation on the /portal/search.htm endpoint should be implemented to sanitize user input and prevent the injection of malicious code. Monitor system logs for unusual activity, particularly attempts to execute PHP code from unexpected sources. After upgrading, confirm the vulnerability is resolved by attempting a code injection attack via the /portal/search.htm endpoint and verifying that the request is properly sanitized.