Skip to content

Latest commit

 

History

History
40 lines (26 loc) · 1.49 KB

command-injection1.md

File metadata and controls

40 lines (26 loc) · 1.49 KB
Raw

Affected device

production: EX300_v2
version: V4.0.3c.140_B20210429

Vulnerability description

Vulnerability Type: RCE

A command injection was found in EX300_v2, V4.0.3c.140_B20210429. The update process cloudupdate_check of the router allows adjacent unauthenticated attackers to achieve remote code execution as root via a MitM attack.

cloudupdate_check will check whether there is new version from firmware server, and update config file /var/cloudupg.ini. Here we can perform a MITM attack and return malicious response to cloudupdate_check , and inject command in value magicid and url .

  • post to firmware server to check new firmware

​ Since device requests by HTTP, so we can hijack dns request ,and the repeater will connect to the attacker server instead of legal one.

  • cloudupdate_check
 if ( !strncmp(Var, &a30, 3)
    && (v3 = websGetVar(a1, "mode", "0"), v4 = atoi(v3), (v5 = v4) != 0)
    && (inifile_set_int("/var/cloudupg.ini", "INFO", "mode", v4), url = (const char *)websGetVar(a1, &aUrl, ""), *url) )
  {
    inifile_set("/var/cloudupg.ini", "INFO", &aUrl, url);
    magicid = (const char *)websGetVar(a1, "magicid", "");
    v8 = (const char *)websGetVar(a1, "version", "");
    v9 = (const char *)websGetVar(a1, "svn", "");
    snprintf(buf, 256, "echo %s > /tmp/ActionMd5", magicid); //命令注入
    system(buf);
    snprintf(buf, 256, "echo %s > /tmp/DlFileUrl", url);//命令注入
    system(buf);