PT-2021-20126 · Raspap · Raspap

Published 2021-06-09 · Updated 2021-06-21 · CVE-2021-33358

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RaspAP versions 2.3 through 2.6.5

Description The issue allows an authenticated attacker to execute arbitrary OS commands by exploiting vulnerabilities in the interface, ssid, and wpa passphrase POST parameters in the "/hostapd" API endpoint. This can occur when the parameter values contain special characters such as ";" or "$()".

Recommendations For RaspAP versions 2.3 through 2.6.5, avoid using the interface, ssid, and wpa passphrase parameters in the "/hostapd" API endpoint with special characters until a patch is available. As a temporary workaround, consider restricting access to the "/hostapd" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-33358

Affected Products

Raspap

References · 5

• 🔥 https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.php · Exploit
• 🔥 https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33358 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33358 · Vendor Advisory
• https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf · Note