| 标题 | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| 描述 | The handler UploadFirmwareFile is the backend endpoint of the firmware upgrade feature and is not referenced by the public part of the web interface. It reads the file_name and content_length fields of the JSON request body, verifies that the claimed length is within the flash capacity and runs a firmware validity check, and on every outcome other than a successful verification it composes the shell string rm -f <file_name> and executes it through CsteSystem, which runs /bin/sh -c with that text as root. The file name is inserted into the command without quoting and without any character validation, so a semicolon in the field terminates the rm invocation and introduces an arbitrary command. Sending a content_length of zero is sufficient to take the failing branch, because zero is not greater than zero, and the cleanup command is then executed unconditionally on the attacker-supplied name. The dispatch table registers the handler as requiring authentication, and it is additionally reachable through the upload endpoint /uploadfile.cgi, which applies no authentication check of its own; the JSON path demonstrated below requires a valid session token, obtained through loginAuth. The result is arbitrary command execution as root, with the additional property that this endpoint is the firmware upgrade path and therefore already the natural target for a persistent compromise. |
|---|
| 来源 | ⚠️ https://gist.github.com/H3rmesk1t/2f5fc88e57ce67815db3676ef393068e |
|---|
| 用户 | LiuYijun (UID 101805) |
|---|
| 提交 | 2026-09-30 08時21分 (18 日前) |
|---|
| 管理 | 2026-10-17 23時58分 (18 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 244067 [Totolink A3300R 17.0.0cu.557_B20221024 UploadFirmwareFile file_name 权限提升] |
|---|
| 积分 | 0 |
|---|