PT-2023-6140 · Raspap · Raspap

CVE-2022-39986 · Publicado 2023-08-01 · Atualizado 2023-10-16

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RaspAP versions 2.8.0 through 2.8.7

Description A command injection issue allows unauthenticated attackers to execute arbitrary commands via the cfg id parameter in "/ajax/openvpn/activate ovpncfg.php" and "/ajax/openvpn/del ovpncfg.php". This is related to inadequate data cleaning at the management level, potentially allowing remote attackers to execute commands using a specially crafted POST request with the cfg id parameter.

Recommendations For RaspAP versions 2.8.0 through 2.8.7, consider disabling the cfg id parameter in the affected API endpoints until a patch is available. Restrict access to the "/ajax/openvpn/activate ovpncfg.php" and "/ajax/openvpn/del ovpncfg.php" endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-06846

CVE-2022-39986

GHSA-7C28-WG7R-PG6F

Produtos afetados

Raspap

Referências · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/raspap_rce.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39986.json · Exploit
• 🔥 https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 · Exploit
• https://github.com/RaspAP/raspap-webgui · Nota
• https://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php · Aviso do Fabricante
• https://github.com/RaspAP/raspap-webgui/pull/1303 · Nota
• https://github.com/RaspAP/raspap-webgui/commit/1fabc481690e008279113e18d0642c5279e3b56e · Nota
• https://osv.dev/vulnerability/GHSA-7c28-wg7r-pg6f · Aviso do Fabricante
• https://twitter.com/Wh1t3_Ow1/status/1691775571506630680 · Publicação no Twitter
• https://t.me/cibsecurity/67513 · Publicação no Telegram
• https://twitter.com/cyber_advising/status/1695403236809724003 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2022-39986 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06846 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-39986 · Aviso do Fabricante
• https://twitter.com/ptracesecurity/status/1695692663448588678 · Publicação no Twitter