| 标题 | RaspAP RaspAP WebGUI 2.8.8-3.5.5 Improper Access Control / Arbitrary File Deletion |
|---|
| 描述 | RaspAP WebGUI is vulnerable to authenticated arbitrary file deletion via the OpenVPN configuration handler at POST /ajax/openvpn/del_ovpncfg.php, parameter cfg_id.
Root cause: the endpoint builds a "sudo rm" command by directly concatenating the user-controlled cfg_id POST value into a filesystem glob path, after passing it only through escapeshellcmd() (ajax/openvpn/del_ovpncfg.php, lines 9-15). escapeshellcmd() escapes shell metacharacters (;, |, &, backtick, $, etc.) but does NOT escape whitespace or the "/" path separator. This lets an authenticated attacker inject an additional, fully attacker-chosen argument into the "sudo rm" invocation via a space in cfg_id.
The corresponding NOPASSWD sudoers rule (installers/raspap.sudoers, line 41: "www-data ALL=(ALL) NOPASSWD:/bin/rm /etc/openvpn/client/*.conf") grants unrestricted www-data -> root execution of /bin/rm for any argument list matching the trailing-wildcard pattern. Because sudo's command-argument matching evaluates the full argument list against this pattern rather than confining each shell-expanded word individually, the smuggled second argument is honored, allowing root to delete an attacker-chosen file. Two real constraints bound this primitive: the target file must already exist, and its name must fit <attacker-chosen-prefix>_<anything>.conf (the code appends a literal "_*.conf" after the injected prefix). Example: cfg_id="x /etc/dnsmasq.d/pwn" causes root to run "sudo rm /etc/openvpn/client/x /etc/dnsmasq.d/pwn_*.conf", deleting any pre-existing /etc/dnsmasq.d/pwn_*.conf file.
Verification: executed the complete real attacker chain over HTTP (login -> CSRF token -> authenticated POST) against a Docker environment running the real, unmodified RaspAP source as www-data with the real sudoers rule installed and validated via visudo -c. A root-owned target file outside /etc/openvpn/client/ was confirmed deleted. Negative controls performed beforehand: sudo access denied for www-data without a matching rule; the intended narrow rule (deleting a file actually inside /etc/openvpn/client/) succeeds normally, confirming the rule itself was correctly installed and enforcement was genuinely active.
Affected versions: introduced in commit 1fabc481 ("Sanitize post data w/ escapeshellcmd()"), first shipped in tag 2.8.8, confirmed unchanged through current HEAD (tag 3.5.5).
Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 6.5) - authenticated, network-reachable, no confidentiality/integrity impact on data content, but full availability impact on the targeted configuration file (denial of service / config-integrity impact).
Full reproduction kit (Dockerfile, HTTP exploit script, captured verification logs) is linked below. Vendor ([email protected], per SECURITY.md) was notified by email prior to this submission; no response was received.
Note: this is a distinct, independent primitive (file deletion, not code execution) from the two other RaspAP vulnerabilities submitted alongside this one, and is not part of their RCE/privilege-escalation chain. |
|---|
| 来源 | ⚠️ https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c |
|---|
| 用户 | inmoyang (UID 89515) |
|---|
| 提交 | 2026-08-15 10時26分 (2 月前) |
|---|
| 管理 | 2026-09-28 17時43分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 411093 [RaspAP raspap-webgui 直到 3.5.5 OpenVPN Configuration del_ovpncfg.php escapeshellcmd cfg_id 权限提升] |
|---|
| 积分 | 20 |
|---|