| 제목 | SECCN SECCN G10 VPN V3.1.0.181203 Unauthorized RCE |
|---|
| 설명 | Technical Analysis (Vulnerability Logic):
Source of Taint: The variable $in{user} is a controlled input fetched directly from a Web POST request via the ReadParse function.
Insecure Sink: The script utilizes Perl's system qq(...) function to execute backend logic. In Perl, qq acts as a double-quote interpolator, meaning it evaluates and embeds variables into the string before passing it to the system shell.
Exploitation (Command Chaining): Because the $in{user} variable is not sanitized, an attacker can inject a shell command separator (;). For instance, a payload like 13800000000;telnetd -p 9999; transforms the command into a multi-step execution:
Step 1: user_auth.pl ... 13800000000 (Original intended command)
Step 2: telnetd -p 9999 (Injected malicious command)
Step 3: [trailing_random_numbers] (System noise)
Pre-Auth Reachability: The injection point is located within the SMS verification trigger logic. Since this functionality must be accessible before a user is authenticated, it allows for a complete Pre-auth RCE. |
|---|
| 원천 | ⚠️ https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md |
|---|
| 사용자 | Ruler-Chovy (UID 95098) |
|---|
| 제출 | 2026. 02. 08. AM 09:19 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 18. PM 03:13 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 346488 [SECCN Dingcheng G10 3.1.0.181203 session_login.cgi qq user 권한 상승] |
|---|
| 포인트들 | 20 |
|---|