| Titel | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Beschreibung | UploadCustomModule is the handler that installs the vendor's optional customisation module. It is implemented in lib/cste_modules/product.so and dispatched by bin/cste_sub from the topic totolink/router/product/UploadCustomModule. The handler is explicitly exempted from authentication: the gate in cstecgi.cgi treats a request as authenticated when the routing key contains the substring UploadCustomModule, so the request reaches the handler without a token, without a session and without any credential. The handler then reads four values out of the request JSON — Action, data.FileMd5, data.FileUrl and data.File — and applies only two checks to them: Action must equal the literal GetCustomModule, and FileUrl must contain the substring custom.so. The File member is a base64-encoded shared object which is copied into a 204800-byte stack buffer with strcpy, decoded with base64_decode, written to /tmp/custom_file, and hashed with Cal_file_md5. The resulting digest is compared against the FileMd5 value that the same request supplied, so the integrity check is self-referential and is satisfied by simply computing the MD5 of the payload and sending it back. On a match the file is copied to /tmp/custom/cste_modules/custom.so and a forked child executes system("initcste &"), which restarts the framework and causes bin/cste_sub to load every shared object in /tmp/custom/cste_modules/ and /lib/cste_modules/. The result is arbitrary code execution as root from a single unauthenticated HTTP request: an attacker uploads a MIPS32 shared object that runs in the address space of the daemon that owns all 234 business handlers. There is no signature check, no vendor check, no path confinement and no authentication anywhere in the path, and the reload is triggered by the same request rather than by an administrator action. |
|---|
| Quelle | ⚠️ https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794 |
|---|
| Benutzer | H3rmesk1t (UID 70306) |
|---|
| Einreichung | 09.10.2026 08:17 (vor 13 Tagen) |
|---|
| Moderieren | 21.10.2026 20:18 (13 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 424943 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 product.so UploadCustomModule FileMd5 erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|