| शीर्षक | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| विवरण | setDiagnosisCfg is the diagnostic ping tool. It is implemented in lib/cste_modules/system.so and dispatched by bin/cste_sub from the topic totolink/router/system/setDiagnosisCfg. The handler reads the target with websGetVar(a2, "ipDoamin", "www.baidu.com") and passes it to Validity_check before interpolating it into sprintf(s, "ping %s -w 4 &>/var/log/pingCheck", Var) and calling CsteSystem(s, 0). This is one of the four handlers in the firmware that do apply the framework's filter, so the naive payloads are rejected: the semicolon, the pipe, the ampersand, the backtick, the dollar sign, the greater-than sign, the slash and the literal strings .sh, iptables and telnetd are all blocked. The filter is however an incomplete blacklist, and the character it omits is the one that matters most here: the line feed. The value is interpolated into the command line without any quoting, so a line feed in ipDoamin terminates the ping command and starts a new one, and the remainder of the format string — the -w 4 &>/var/log/pingCheck suffix — can be neutralised with a hash so that the shell ignores it. A payload such as x.x.x.x<LF>id<LF># therefore produces three lines: ping x.x.x.x, id, and a comment. The command runs as root. Because the slash is blocked, payloads that name a path cannot be used directly; the practical forms are short commands whose output is not returned (id, ls, ps) or a reverse shell that does not contain a slash, such as nc -l -p 2323 -e sh. |
|---|
| स्रोत | ⚠️ https://gist.github.com/H3rmesk1t/a615ea3dc4b28e0078acf0bc7623619b |
|---|
| उपयोगकर्ता | H3rmesk1t (UID 70306) |
|---|
| सबमिशन | 09/10/2026 08:22 AM (18 दिन पहले) |
|---|
| संयम | 21/10/2026 08:17 PM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 195146 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setDiagnosisCfg ipDoamin अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|