Soumettre #977225: TOTOLINK A3002MU V1.0.0-B20230403.1455 Path Traversal

The file-upload handler of the TOTOLINK A3002MU derives the name of the file it writes from the filename attribute of the multipart request rather than from any server-generated value, and it uses that name verbatim in the destination path. The handler is reached by posting a multipart body to /boafrm/formUploadFile; the uploaded bytes are located by sub_44AFA8, which searches the body for a recognised part header and returns the offset at which the content begins, and the destination name is then extracted by sub_44B250, which locates the substring filename=, takes the text between the following pair of double quotes and copies it with strncpy into a fixed buffer. That extraction performs no basename reduction and applies no filtering of the .. or / characters, so a value such as ../../pwn_upl.htm is accepted as-is and is subsequently concatenated into the destination by sub_44AE68 as /var/web/fw/<product>/<filename>, after which the same function writes the uploaded content to that path with open(), write() and close() through sub_45D2D8. The process runs as root, and the destination base directory is five levels below the filesystem root, so two levels of .. reach the web document root and further levels reach /var and /. Two related properties make the write immediately useful to an attacker. First, the validator sub_45E944 only inspects the structured container at the beginning of the uploaded content and then returns success, while the writer copies the entire remaining body, so arbitrary bytes appended after a minimal container are written verbatim; the attacker therefore controls both the path and the content. Second, because /var/web is the Boa document root and the server runs as root, a file written into it is served to any unauthenticated client, which turns the primitive into content injection against every administrator of the device, usable for credential phishing, for delivering malicious scripts under the device's own origin and for persistent defacement. The same server has CGI execution enabled globally through the cgi extension mapping, and a .cgi file under the document root is routed to the CGI handler rather than served statically, so the write would additionally yield code execution as root wherever an executable target can be supplied; the writer creates files with a mode that contains no execute bits, so that escalation is documented as conditional rather than as the primary impact.

• La source: ⚠️ https://gist.github.com/H3rmesk1t/b107cde70392e0aff26e8219bae1a181
• Utilisateur: H3rmesk1t (UID 70306)
• Soumission: 14/09/2026 11:02 (il y a 22 jours)
• Modérer: 05/10/2026 00:18 (21 days later)
• Statut: Accepté
• Entrée VulDB: 413467 [Totolink A3002MU 1.0.0-B20230403.1455 File Upload /boafrm/formUploadFile sub_44B250 filename directory traversal]
• Points: 20