| عنوان | RaspAP RaspAP WebGUI 2.8.8-3.5.5 Improper Access Control / Arbitrary File Deletion |
|---|
| الوصف | RaspAP WebGUI is vulnerable to authenticated arbitrary file deletion via the OpenVPN configuration handler at POST /ajax/openvpn/del_ovpncfg.php, parameter cfg_id.
Root cause: the endpoint builds a "sudo rm" command by directly concatenating the user-controlled cfg_id POST value into a filesystem glob path, after passing it only through escapeshellcmd() (ajax/openvpn/del_ovpncfg.php, lines 9-15). escapeshellcmd() escapes shell metacharacters (;, |, &, backtick, $, etc.) but does NOT escape whitespace or the "/" path separator. This lets an authenticated attacker inject an additional, fully attacker-chosen argument into the "sudo rm" invocation via a space in cfg_id.
The corresponding NOPASSWD sudoers rule (installers/raspap.sudoers, line 41: "www-data ALL=(ALL) NOPASSWD:/bin/rm /etc/openvpn/client/*.conf") grants unrestricted www-data -> root execution of /bin/rm for any argument list matching the trailing-wildcard pattern. Because sudo's command-argument matching evaluates the full argument list against this pattern rather than confining each shell-expanded word individually, the smuggled second argument is honored, allowing root to delete an attacker-chosen file. Two real constraints bound this primitive: the target file must already exist, and its name must fit <attacker-chosen-prefix>_<anything>.conf (the code appends a literal "_*.conf" after the injected prefix). Example: cfg_id="x /etc/dnsmasq.d/pwn" causes root to run "sudo rm /etc/openvpn/client/x /etc/dnsmasq.d/pwn_*.conf", deleting any pre-existing /etc/dnsmasq.d/pwn_*.conf file.
Verification: executed the complete real attacker chain over HTTP (login -> CSRF token -> authenticated POST) against a Docker environment running the real, unmodified RaspAP source as www-data with the real sudoers rule installed and validated via visudo -c. A root-owned target file outside /etc/openvpn/client/ was confirmed deleted. Negative controls performed beforehand: sudo access denied for www-data without a matching rule; the intended narrow rule (deleting a file actually inside /etc/openvpn/client/) succeeds normally, confirming the rule itself was correctly installed and enforcement was genuinely active.
Affected versions: introduced in commit 1fabc481 ("Sanitize post data w/ escapeshellcmd()"), first shipped in tag 2.8.8, confirmed unchanged through current HEAD (tag 3.5.5).
Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 6.5) - authenticated, network-reachable, no confidentiality/integrity impact on data content, but full availability impact on the targeted configuration file (denial of service / config-integrity impact).
Full reproduction kit (Dockerfile, HTTP exploit script, captured verification logs) is linked below. Vendor ([email protected], per SECURITY.md) was notified by email prior to this submission; no response was received.
Note: this is a distinct, independent primitive (file deletion, not code execution) from the two other RaspAP vulnerabilities submitted alongside this one, and is not part of their RCE/privilege-escalation chain. |
|---|
| المصدر | ⚠️ https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c |
|---|
| المستخدم | inmoyang (UID 89515) |
|---|
| ارسال | 15/08/2026 10:26 AM (1 شهر منذ) |
|---|
| الاعتدال | 28/09/2026 05:43 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 411093 [RaspAP raspap-webgui حتى 3.5.5 OpenVPN Configuration del_ovpncfg.php escapeshellcmd cfg_id تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|