CVE-2024-58275
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jpylypiw | easywall | 0.3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Easywall 0.3.1 is a command injection flaw in the /ports-save endpoint. Authenticated attackers can inject shell metacharacters into parameters, allowing them to execute arbitrary commands on the server remotely.
How can this vulnerability impact me? :
The vulnerability allows authenticated attackers to execute arbitrary commands on the server, which can lead to unauthorized control over the system, data compromise, service disruption, or further exploitation of the affected environment.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting an authenticated test to the /ports-save endpoint with a payload that includes shell metacharacters to check for command injection. For example, using a script similar to the one described in Resource 1, you can authenticate to the Easywall web application and send a POST request to /ports-save with a crafted 'port' parameter containing a harmless command injection payload (e.g., `; echo vulnerable; #`). Monitoring the server's response or behavior for execution of the injected command indicates the presence of the vulnerability. Commands to test manually could include using curl to authenticate and then send a payload: 1) Authenticate: `curl -c cookies.txt -d "username=admin&password=admin" -X POST https://<easywall-ip>/login` 2) Test injection: `curl -b cookies.txt -d "port=1; echo vulnerable; #" -X POST https://<easywall-ip>/ports-save` 3) Observe if the injected command output appears or if unexpected behavior occurs. Note that valid credentials are required to perform these tests. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the Easywall management interface to trusted users only, ensuring that only authorized personnel can authenticate. 2) Change default or weak credentials to strong, unique passwords to prevent unauthorized authentication. 3) Monitor and audit logs for suspicious activity related to the /ports-save endpoint. 4) If possible, apply any available patches or updates from the Easywall project that address this vulnerability. 5) As a temporary measure, consider disabling or restricting the /ports-save endpoint if it is not essential. 6) Implement network-level controls such as firewall rules to limit access to the Easywall server. These steps reduce the risk of exploitation until a permanent fix is applied. [2]