| タイトル | EasyNAS 1.1.0 - Authenticated OS Command Injection |
|---|
| 説明 | The vulnerability is present in the backup and restore script, which is used to create and restore backups of the EasyNAS system. The vulnerability lies in the use of the system function to execute a command with user-supplied input. The following is the vulnerable script code "/backup.pl" on line 20:
$rc=system("/usr/bin/sudo /usr/bin/tar cvf $mount_dir/$vol/$file @config_files > /dev/null" );
As seen in the code above, the script is using the system function to execute the command:
/usr/bin/sudo /usr/bin/tar cvf $mount_dir/$vol/$file @config_files > /dev/null
This command creates a backup of certain system files and stores it in the $mount_dir/$vol directory. The problem is that the $file variable and the $vol variable are being passed in as user-supplied input, without proper validation or sanitization. An attacker can craft a malicious GET request to the WebUI of the EasyNAS system, injecting a malicious command into the "name" and "vol" parameters of the GET request.
https://gist.github.com/xbz0n/674af0e802efaaafe90d2f67464c2690 |
|---|
| ユーザー | xbz0n (UID 40658) |
|---|
| 送信 | 2023年02月09日 15:07 (3 年 ago) |
|---|
| モデレーション | 2023年02月14日 17:13 (5 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 220950 [EasyNAS 1.1.0 /backup.pl system 特権昇格] |
|---|
| ポイント | 17 |
|---|