Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-52875 | CRLF Injection/Open Redirect in GFI Kerio Control Enables Reflected XSS and RCE CVE-2024-52875 is an HTTP response splitting flaw (CWE-113) in GFI Kerio Control 9.2.5 through 9.4.5, where the unauthenticated 'dest' GET parameter on the /nonauth/addCertException.cs, /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is placed into the Location header of a 302 redirect without sanitization. An attacker triggers it by convincing a user to open a crafted link containing CRLF sequences in the 'dest' parameter, which yields open redirects, HTTP response splitting, and reflected cross-site scripting. Beyond XSS, the flaw can be escalated to remote command execution by abusing the upgrade feature in the Kerio Control admin interface, as demonstrated in published research. Any organization running Kerio Control 9.2.5 through 9.4.5 — typically SMB firewall/VPN gateway appliances or virtual appliances — is affected. No confirmed in-the-wild exploitation is documented and the issue is not in CISA KEV, but two public proofs of concept exist and a 29.6% EPSS score (98th percentile) indicates a high likelihood of exploitation attempts within 30 days. Do: Upgrade Kerio Control to a release later than 9.4.5, which resolves this issue. Until patched, minimize internet exposure of the Kerio Control admin and /nonauth/ pages (restrict management access to trusted networks) and treat any emailed or linked URLs pointing to the appliance's addCertException.cs, guestConfirm.cs or expiration.cs pages as untrusted. Monitor the appliance for unexpected upgrade activity or admin-interface sessions, since the known escalation path runs through the admin upgrade feature. | 8.8 | 30% | PoC ×2 |
| large≈ tens of thousands of internet-exposed Kerio Control instances (estimated, no official install base in source data) |
Full article410 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 09, 2025Vulnerability / Threat Intelligence
Threat actors are attempting to take advantage of a recently disclosed security flaw impacting GFI KerioControl firewalls that, if successfully exploited, could allow malicious actors to achieve remote code execution (RCE).
The vulnerability in question, CVE-2024-52875, refers to a carriage return line feed (CRLF) injection attack, paving the way for HTTP response splitting, which could then lead to a cross-site scripting (XSS) flaw.
Successful exploitation of the 1-click RCE flaw permits an attacker to inject malicious inputs into HTTP response headers by introducing carriage return (\r) and line feed (\n) characters.
The flaw impacts KerioControl versions 9.2.5 through 9.4.5, according to security researcher Egidio Romano, who discovered and reported the flaw in early November 2024.
The HTTP response splitting flaws have been uncovered in the following URI paths -
- /nonauth/addCertException.cs
- /nonauth/guestConfirm.cs
- /nonauth/expiration.cs
"User input passed to these pages via the 'dest' GET parameter is not properly sanitized before being used to generate a 'Location' HTTP header in a 302 HTTP response," Romano said.
"Specifically, the application does not correctly filter/remove line feed (LF) characters. This can be exploited to perform HTTP Response Splitting attacks, which, in turn, might allow it to carry out reflected cross-site scripting (XSS) and possibly other attacks."
A fix for the vulnerability was released by GFI on December 19, 2024, with version 9.4.5 Patch 1. A proof-of-concept (PoC) exploit has since been made available.
Specifically, an adversary could craft a malicious URL such that an administrator user clicking on it triggers the execution of the PoC hosted on an attacker-controlled server, which then uploads a malicious .img file via the firmware upgrade functionality, granting root access to the firewall.
Threat intelligence firm GreyNoise has reported that exploitation attempts targeting CVE-2024-52875 commenced back on December 28, 2024, with the attacks originating from seven unique IP addresses from Singapore and Hong Kong to date.
According to Censys, there are more than 23,800 internet-exposed GFI KerioControl instances. A majority of these servers are located in Iran, Uzbekistan, Italy, Germany, the United States, Czechia, Belarus, Ukraine, Russia, and Brazil.
The exact nature of the attacks exploiting the flaw is presently not known. Users of KerioControl are advised to take steps to secure their instances as soon as possible to mitigate potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/critical-rce-flaw-in-gfi-keriocontrol.html