| タイトル | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| 説明 | The remote syslog handler setSyslogCfg reads the rtLogServer field of the JSON request body and, when the rtLogEnabled field is non-zero, composes the shell string syslogd -R <rtLogServer>:514. The value is inserted between a space and a literal :514 suffix with no quoting and no filtering, so a semicolon terminates the syslogd invocation and introduces an arbitrary command. The composed string is executed through CsteSystem, which runs /bin/sh -c with that text under the root account used by the web server. The value is also written into the syslog.host configuration option, so the payload persists in the device configuration. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. A separate killall syslogd invocation runs before the composed command and is itself constant, so the injection vector is solely the server address field. The outcome is arbitrary command execution as root combined with a persistent configuration modification. |
|---|
| ソース | ⚠️ https://gist.github.com/H3rmesk1t/1b5a45bba65b1ac521448b4c0d62833f |
|---|
| ユーザー | LiuYijun (UID 101805) |
|---|
| 送信 | 2026年09月30日 08:21 (19 日 ago) |
|---|
| モデレーション | 2026年10月17日 23:58 (18 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 329931 [TOTOLINK A3300R 17.0.0cu.557_B20221024 POST Parameter /cgi-bin/cstecgi.cgi setSyslogCfg enable メモリ破損] |
|---|
| ポイント | 0 |
|---|