exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/285733 CVE-2024-30167
MEDIUM
Atlona ATOMERX21 - Authenticated Command Injection
Record summary
CVE-2024-30167 has a selected CVSS score of 6.3 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.
Description
/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter.
Description source: CVE List
Exploitation context
Proofs of concept
2Catalogued exploits
ExploitDBAtlona ATOMERX21 - Authenticated Command InjectionExploitDB exploitby rizzziomExploit1 file
Analysis
Technical assessment
Go source code that exploits CVE-2024-30167, an authenticated command injection in Atlona AT-OME-RX21 firmware <= 1.5.1. It sends a crafted JSON POST request to /cgi-bin/time.cgi with a malicious serverName parameter containing a shell command, then listens for the command output via a local HTTP server.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code implements a straightforward authenticated command injection exploit against Atlona AT-OME-RX21 devices. It sends a crafted JSON payload to /cgi-bin/time.cgi, starts a local HTTP listener to receive command output, and performs a graceful shutdown. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed.
ClassificationExploit
Model confidence100%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2024-30167 by sending a crafted request that injects an arbitrary shell command into the serverName parameter, causing the target to execute it and return output to an attacker-controlled listener. This is a full exploit, not merely a scanner or writeup.
exploits/multiple/local/52513.go:1-10exploits/multiple/local/52513.go:95-134Requirements
- Valid credentials for the target device (default admin:Atlona)
exploits/multiple/local/52513.go:41-42 - Network access to the target device's /cgi-bin/time.cgi endpoint
exploits/multiple/local/52513.go:54 - Attacker must run a listener reachable by the target to receive command output
exploits/multiple/local/52513.go:43-44
Observed behavior
- Constructs a JSON payload with a command injection in the serverName field, using curl to POST command output back to the attacker's listener
exploits/multiple/local/52513.go:97 - Sends an authenticated POST request to the target's /cgi-bin/time.cgi endpoint with the malicious payload
exploits/multiple/local/52513.go:99-112 - Starts a local HTTP server to receive the exfiltrated command output from the target
exploits/multiple/local/52513.go:159-184
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe payload injects a command into the serverName parameter, using curl to POST the output of the attacker-supplied command back to the attacker's listener. This is the core exploit mechanism.
exploits/multiple/local/52513.go:97 - Listener
- Payload withheldThe exploit starts an HTTP server to receive the exfiltrated command output from the target device.
exploits/multiple/local/52513.go:55exploits/multiple/local/52513.go:65exploits/multiple/local/52513.go:159-184 - Authentication
- Payload withheldThe exploit uses HTTP Basic authentication with credentials provided via command-line flags (defaults: admin/Atlona).
exploits/multiple/local/52513.go:41-42exploits/multiple/local/52513.go:98exploits/multiple/local/52513.go:105
What the analysis did not establish
- Only the exploit source code is provided; no external dependencies, build instructions, or execution environment are included.
- The code is not executed or verified; classification is based solely on static analysis of the supplied text.
- Only the supplied Go source file was reviewed; no external dependencies, compiled binaries, or runtime behavior were analyzed.
- The review does not assess the safety or legality of using this exploit against systems without authorization.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Repository PoCs
GitHubRIZZZIOM/CVE-2024-30167Repository PoCby RIZZZIOMStars: 1Exploit3 files
Analysis
Technical assessment
Go-based authenticated remote command injection exploit targeting Atlona AT-OME-RX21 AV switcher firmware <= 1.5.1 via the /cgi-bin/time.cgi endpoint. The code sends a crafted JSON payload with a command injection in the serverName parameter, starts a local HTTP listener to receive command output, and executes arbitrary OS commands as root.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Go-based proof-of-concept (PoC) for CVE-2024-30167, an authenticated command injection vulnerability in Atlona AV switchers. The code sends a crafted JSON payload to the target's /cgi-bin/time.cgi endpoint, injecting a command that exfiltrates output to a listener controlled by the operator. All behavior is consistent with the stated exploit purpose: no concealed backdoor, persistence, credential theft, or unrelated payload was observed.
ClassificationExploit
Model confidence98%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by sending a crafted payload that injects and executes an arbitrary OS command on the target, and then retrieves the output. This is not merely checking for the vulnerability; it performs the full exploitation chain.
main.go:95-134main.go:136-157Requirements
- Valid credentials for the target Atlona device (default admin:Atlona).
main.go:41-42 - Network access to the target device's /cgi-bin/time.cgi endpoint.
main.go:54 - Attacker must run a listener reachable by the target to receive command output.
main.go:44
Observed behavior
- Constructs a JSON payload with a command injection in the serverName field, appending a curl command that POSTs the output of the attacker-supplied command back to the attacker's listener.
main.go:97 - Sends the payload via HTTP POST with Basic authentication to the target's /cgi-bin/time.cgi.
main.go:98-106 - Starts an HTTP server on the attacker-controlled host and port to receive the command output from the target.
main.go:159-185 - Prints the received command output to stdout.
main.go:143-150
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe payload injects an operator-supplied command into the serverName parameter and exfiltrates the output via curl to a listener host:port specified by the operator.
main.go:97 - Listener
- Payload withheldThe PoC starts an HTTP server to receive the command output sent by the compromised target. This is standard for blind command injection exploits.
main.go:159-185 - Authentication
- Payload withheldThe exploit uses HTTP Basic authentication to access the vulnerable endpoint, consistent with the CVE description of an authenticated command injection.
main.go:98-105
What the analysis did not establish
- Evidence consists of complete source code and README; no binary or opaque content. No execution or dynamic analysis was performed.
- Only the three text files (README.md, go.mod, main.go) were reviewed; no binary artifacts were present or analyzed.
- The review does not assess whether the exploit works as claimed or whether the target device is actually vulnerable.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-30167