PT-2024-5491 · Raspap+1 · Raspap+1

Aaron Haymore · Published 2024-07-16 · Updated 2024-08-01 · CVE-2024-41637

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions RaspAP versions prior to 3.1.5

Description The issue is related to the restapi.service file (/lib/systemd/system/restapi.service) in RaspAP, a software for creating wireless routers based on Debian. It is caused by the lack of measures to neutralize special elements used in commands due to insufficient access restriction for the www-data user group. This can allow a remote attacker to escalate privileges and execute arbitrary commands. The www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.

Recommendations For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting the write access to the restapi.service file for the www-data user and limiting the Sudo privileges to prevent the execution of critical commands without a password.

Fix

Improper Privilege Management

Command Injection

Weakness Enumeration

CWE-269

CWE-77

Related Identifiers

BDU:2024-06140

CVE-2024-41637

GHSA-Q623-2J2J-23JJ

Affected Products

Debian

Raspap

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-41637 · Security Note
• https://osv.dev/vulnerability/GHSA-q623-2j2j-23jj · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06140 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41637 · Vendor Advisory
• https://github.com/RaspAP/raspap-webgui · Note
• https://t.me/cvenotify/87706 · Telegram Post
• https://t.me/cvedetector/1808 · Telegram Post
• https://blog.0xzon.dev/2024-07-27-CVE-2024-41637 · Note
• https://asec.ahnlab.com/en/82193 · Note