提交 #930246: RaspAP RaspAP WebGUI 2.8.0-3.5.5 OS Command Injection

RaspAP WebGUI is vulnerable to authenticated OS command injection via the Wi-Fi client SSID field, reachable at POST /wpa_conf (client_settings action, includes/configure_client.php), which is handled by WiFiManager::writeWpaSupplicant() in src/RaspAP/Networking/Hotspot/WiFiManager.php (line 795).

Root cause: escapeshellarg() is applied to the user-controlled SSID BEFORE its \xHH hex-escape sequences are decoded by ssid2utf8()/evalHexSequence() (includes/functions.php, evalHexSequence()). Because hex-decoding happens AFTER shell-quoting, a \x27 sequence decodes to a literal single-quote inside the already-quoted argument, allowing an attacker to break out of the quoted shell argument and inject arbitrary commands into the exec() call. Example payload: ssid=\x27;<command>;\x27

The resulting command executes as the www-data user (the actual RaspAP deployment user). CSRF is enforced but does not prevent this, as the attack requires only a valid authenticated session (RaspAP has a single admin account, RASPI_AUTH_ENABLED).

This RCE further chains to full root compromise via a separate, independently reported vulnerability: an unrestricted NOPASSWD sudoers rule for installers/plugin_helper.sh (installers/raspap.sudoers), whose "sudoers" action installs an attacker-supplied file into /etc/sudoers.d/ without validation. The injected command can therefore install a new sudoers rule and escalate www-data to root.

Verification: built a Docker environment running the real, unmodified RaspAP source over HTTP as www-data, with the real sudoers rules installed. Executed the complete real attacker chain (login -> CSRF token -> authenticated POST) using curl only. Confirmed the injected command executed as www-data, and confirmed the chained escalation to root (uid=0), both over HTTP. Negative controls performed: sudo access denied for www-data before exploitation; benign SSID values do not trigger command execution.

Affected versions: introduced in commit d478bf53 ("Handle non-ASCII SSID"), first shipped in tag 2.8.0, confirmed unchanged through current HEAD (tag 3.5.5).

Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 8.8) standalone; higher when chained to the root-escalation vulnerability due to scope change.

Full reproduction kit (Dockerfile, HTTP exploit scripts, captured verification logs) is linked below. Vendor ([email protected], per SECURITY.md) was notified by email prior to this submission; no response was received.

• 来源: ⚠️ https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c
• 用户: inmoyang (UID 89515)
• 提交: 2026-08-15 10時21分 (2 月前)
• 管理: 2026-09-28 17時43分 (1 month later)
• 状态: 已接受
• VulDB条目: 411092 [RaspAP raspap-webgui 直到 3.5.5 SSID Processing WiFiManager.php writeWpaSupplicant ssid 权限提升]
• 积分: 20