Threat actors are exploiting a recently disclosed GFI KerioControl firewall vulnerability that leads to one-click remote code execution (RCE), threat intelligence firm GreyNoise warns.
GFI KerioControl is a network security solution that provides firewall functionality and unified threat management capabilities, including threat detection and blocking, traffic control, intrusion prevention, and VPN features.
The exploited issue, tracked as CVE-2024-52875 and patched on December 19, is a CRLF injection flaw that can be exploited to perform HTTP response splitting attacks, leading to reflected cross-site scripting (XSS).
According to security researcher Egidio Romano, who published a detailed technical writeup of the vulnerability on December 16, the reflected XSS attack vector can be exploited to perform one-click RCE attacks.
The issue, Romano explains, is the result of multiple HTTP response splitting vulnerabilities in GFI KerioControl, which exist because vulnerable pages fail to properly sanitize user input.
The researcher assesses that – because a nine-year-old exploit can be leveraged when exploiting the vulnerability to gain RCE and because it could potentially allow attackers to deploy a root shell on the firewall – the bug should be considered ‘high severity’, with a CVSS score of 8.8.
Romano, who has released proof-of-concept (PoC) code targeting the security defect, also warns that the bug impacts GFI KerioControl versions 9.2.5 through 9.4.5, meaning that it lurked in the software for roughly seven years.
This week, GreyNoise warned that it has observed multiple exploitation attempts targeting CVE-2024-52875, which “allows attackers to retrieve the device’s CSRF token by leveraging HTTP response splitting and reflected cross-site scripting, potentially enabling 1-click remote code execution under certain conditions”.
Attackers can exploit the flaw by crafting a malicious URL and convincing an authenticated administrator to click on it, which would trigger the upload of a malicious .img file using the firmware upgrade functionality, providing root access to the system.
“This exploit targets unauthenticated URI paths (/nonauth/*), which makes it accessible to external threat actors. By combining this with social engineering tactics, an administrator may be tricked into clicking a malicious URL,” threat intelligence firm Censys says.
The cybersecurity company also notes that it has observed close to 24,000 GFI KerioControl instances accessible from the internet, many of which are in Iran. However, it is unclear how many of these are vulnerable.
Users are advised to update to GFI KerioControl version 9.4.5 Patch 1, which addresses the vulnerability and which has been hardened against XSS exploits.
Related: CISA Warns of Mitel MiCollab Vulnerabilities Exploited in Attacks
Related: Rockwell PowerMonitor Vulnerabilities Allow Remote Hacking of Industrial Systems
Related: Apple Confirms Zero-Day Attacks Hitting macOS Systems
Related: DigiCert Revoking 83,000 Certificates of 6,800 Customers
