| タイトル | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| 説明 | setDeviceName stores the user-visible device name together with the MAC address it is associated with. It is implemented in lib/cste_modules/global.so and dispatched by bin/cste_sub from the topic totolink/router/global/setDeviceName. The handler reads deviceMac and deviceName with websGetVar, both without any length or character validation, and interpolates them into a shell command with sprintf(s, "echo '%s,%s' > /mnt/customDeviceName", Var, v7) followed by system(s). The two conversions are wrapped in single quotes, but the quotes are not escaped and no escaping is applied to the values, so a single quote inside deviceName closes the quoted string and turns the remainder into shell syntax: the value x'; id; ' produces the command line echo 'x',x'; id; '' > /mnt/customDeviceName, in which id is executed as root. The handler contains a second and more interesting path: when /mnt/customDeviceName already exists it is read back line by line, and each line is written again with sprintf(s, "echo '%s' >> /mnt/customDeviceName", s_2) followed by system(s). Any single quote or metacharacter that was stored by a previous request is therefore re-interpreted by a later request, which makes the defect a second-order injection: a value that is harmless when written becomes executable when the handler is invoked a second time, and an administrator who only inspects the stored configuration file will not see a command. Because Validity_check is not called by this handler, the full shell metacharacter set is available. |
|---|
| ソース | ⚠️ https://gist.github.com/H3rmesk1t/b41e4da73ef921d725e00a2088463531 |
|---|
| ユーザー | H3rmesk1t (UID 70306) |
|---|
| 送信 | 2026年10月09日 08:21 (15 日 ago) |
|---|
| モデレーション | 2026年10月21日 20:16 (12 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 307315 [TOTOLINK A950RG 4.1.2cu.5204_B20210112 global.so setDeviceName deviceMac 特権昇格] |
|---|
| ポイント | 0 |
|---|