PT-2023-6140 · Raspap · Raspap

Published 2023-08-01 · Updated 2023-10-16 · CVE-2022-39986

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RaspAP versions 2.8.0 through 2.8.7

Description A command injection issue allows unauthenticated attackers to execute arbitrary commands via the cfg id parameter in "/ajax/openvpn/activate ovpncfg.php" and "/ajax/openvpn/del ovpncfg.php". This is related to inadequate data cleaning at the management level, potentially allowing remote attackers to execute commands using a specially crafted POST request with the cfg id parameter.

Recommendations For RaspAP versions 2.8.0 through 2.8.7, consider disabling the cfg id parameter in the affected API endpoints until a patch is available. Restrict access to the "/ajax/openvpn/activate ovpncfg.php" and "/ajax/openvpn/del ovpncfg.php" endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-06846

CVE-2022-39986

GHSA-7C28-WG7R-PG6F

Affected Products

Raspap

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/raspap_rce.rb · Exploit
• 🔥 https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 · Exploit
• https://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06846 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-39986 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39986 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7c28-wg7r-pg6f · Vendor Advisory
• https://github.com/RaspAP/raspap-webgui · Note
• https://github.com/RaspAP/raspap-webgui/pull/1303 · Note
• https://github.com/RaspAP/raspap-webgui/commit/1fabc481690e008279113e18d0642c5279e3b56e · Note
• https://twitter.com/Wh1t3_Ow1/status/1691775571506630680 · Twitter Post
• http://packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injection.html · Note
• https://twitter.com/ptracesecurity/status/1695692663448588678 · Twitter Post
• https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 · Note
• https://twitter.com/cyber_advising/status/1695403236809724003 · Twitter Post