| タイトル | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| 説明 | The traceroute handler setTracerouteCfg mirrors the structure of the ping handler reported under A3300R-CMD-01. It reads the command field from the JSON request body and the num field, converts the latter to an integer, and composes the shell string traceroute -m <num> <command>&>/var/log/traceRouteLog. The client-supplied value is placed directly into that string with no quoting and no character filtering, and the result is executed through CsteSystem, which runs /bin/sh -c with the composed text. A semicolon in the command field therefore terminates the traceroute invocation and starts an arbitrary command, which the web server executes as root. The handler's entry in the dispatch table carries the authentication flag, so the dispatcher sub_4081AC consults the gate sub_409D2C and the request must present a valid token; the proof of concept below obtains one through loginAuth and sends it as the token query parameter. In the validated payload the address 127.0.0.1 and the hop limit -m 1 were chosen so that the traceroute invocation terminates promptly and the shell proceeds to the appended command; without a terminating invocation the shell would block and the appended command would never run. The outcome is arbitrary command execution with administrative privilege from an unauthenticated network position. |
|---|
| ソース | ⚠️ https://gist.github.com/H3rmesk1t/ac2a4c842233136d1b6ec9422f6f8f85 |
|---|
| ユーザー | H3rmesk1t (UID 70306) |
|---|
| 送信 | 2026年09月27日 16:33 (1 月 ago) |
|---|
| モデレーション | 2026年10月14日 14:50 (17 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 233326 [Totolink A3300R 17.0.0cu.557_B20221024 setTracerouteCfg command 特権昇格] |
|---|
| ポイント | 0 |
|---|