PT-2021-22209 · Raspap · Raspap

Published 2021-08-24 · Updated 2024-02-14 · CVE-2021-38557

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RaspAP version 2.6.6

Description The issue allows attackers to execute commands as root due to insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password. Moreover, the www-data account can overwrite /etc/raspap/hostapd/enablelog.sh with any executable content, further escalating the attack.

Recommendations For RaspAP version 2.6.6, consider restricting the www-data account's access to /etc/raspap/hostapd/enablelog.sh to prevent unauthorized execution and modification. As a temporary workaround, consider disabling the execution of /etc/raspap/hostapd/enablelog.sh as root until a patch is available.

Exploit

Fix

Incorrect Default Permissions

Incorrect Permission

Weakness Enumeration

CWE-276

CWE-732

Related Identifiers

CVE-2021-38557

GHSA-536P-4PCJ-5MR9

Affected Products

Raspap

References · 7

• 🔥 https://zerosecuritypenetrationtesting.com/?page_id=306 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38557 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38557 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-536p-4pcj-5mr9 · Vendor Advisory
• https://github.com/RaspAP/raspap-webgui · Note
• https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/raspap.sudoers · Note
• https://t.me/cibsecurity/27770 · Telegram Post