제출 #930259: RaspAP RaspAP WebGUI 3.2.6-3.5.5 Local Privilege Escalation / Insecure Sudo Configuration

RaspAP WebGUI is vulnerable to local privilege escalation (from www-data to root) due to an unchecked NOPASSWD sudoers rule used in the installer/plugin_helper.sh script.

Root cause: The RaspAP installer specifies the following rule: “www-data ALL=(ALL) NOPASSWD:/etc/raspap/plugins/plugin_helper.sh” (located in installers/raspap.sudoers, line 93). This rule is specified without any argument restrictions. One of the script’s subcommands, “sudoers <file>” (located in installers/plugin_helper.sh, lines 19-31), allows an attacker to modify a file by moving it to /etc/sudoers.d/<basename>. Additionally, the script automatically executes “chown root:root” and “chmod 0440” on that file, without verifying the syntax of the file or restricting the file’s name or content.

This isn’t just a simple oversight: the legitimate plugin-install process (src/RaspAP/Plugins/PluginInstaller.php, addSudoers(), lines 256-262) actually validates the sudoers file using the command “sudo visudo -cf <file>” before calling “plugin_helper.sh sudoers”. There’s also a dedicated sudoers rule in place to enforce this validation (installers/raspap.sudoers, line 92: “www-data ALL=(ALL) NOPASSWD:/usr/sbin/visudo -cf *”). However, this validation only applies at the PHP application level, not at the actual privilege boundaries (the sudoers policy itself). Since the sudoers rule for plugin_helper.sh doesn’t impose any restrictions on the arguments passed to it, any attacker who already has access to execute code at the www-data level (e.g., through SSID command-injection attacks like those described in this report) can directly call “sudo /etc/raspap/plugins/plugin_helper.sh sudoers <file>”, thereby completely bypassing the validation performed by PluginInstaller::addSudoers() and its visudo -cf check. This allows them to create any new sudoers rule with root privileges they can use.“www-data ALL=(ALL) NOPASSWD:ALL”), thereby gaining unrestricted root access.

Verification: deployed the real, unmodified plugin_helper.sh (SHA256: 99632cb044856a79d00aeb9b27d69591664190d1de2989f27524ca7b672b20dd) at the real deployment path /etc/raspap/plugins/plugin_helper.sh (matching installers/common.sh), with the real sudoers rule installed and validated via visudo -c. Executed end-to-end as www-data: negative control confirmed no root access beforehand (sudo -n whoami denied); after writing a malicious sudoers file and invoking plugin_helper.sh sudoers on it, www-data obtained full root (uid=0). This full chain (RCE -> root) was additionally verified purely over HTTP, using the same live Docker environment as the SSID RCE report - a single authenticated POST containing both the injection payload and the sudoers-install command resulted in confirmed root access, with no local shell access required at any point.

Affected versions: plugin_helper.sh and its sudoers rule were both introduced in commit 44c99dac ("Initial commit" of the plugin system), first shipped in tag 3.2.6, confirmed unchanged through current HEAD (tag 3.5.5). Note this is a narrower window (~9 months) than the other two related reports.

Suggested CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.4, local privilege escalation with scope change); when chained from the network-reachable SSID command-injection RCE, the combined chain is remotely exploitable end-to-end (see linked reproduction kit for the HTTP chain log).

Full reproduction kit (Dockerfile, HTTP exploit scripts including the full RCE+root chain, standalone local PoC, captured verification logs) is linked below. Vendor ([email protected], per SECURITY.md) was notified by email prior to this submission; no response was received.

• 원천: ⚠️ https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c
• 사용자: inmoyang (UID 89515)
• 제출: 2026. 08. 15. AM 10:30 (1 월 ago)
• 모더레이션: 2026. 09. 28. PM 05:43 (1 month later)
• 상태: 수락
• VulDB 항목: 411094 [RaspAP raspap-webgui 까지 3.5.5 sudo Configuration PluginInstaller.php addSudoers 권한 상승]
• 포인트들: 20