CVE-2019-19509

Vulnerability

In rConfig 3.9.3, the ajaxArchiveFiles.php endpoint passes the path parameter directly to the exec() function without any sanitization or validation. This allows an authenticated user to inject arbitrary system commands via a crafted GET request. The vulnerability is present in versions up to and including 3.9.3, as described in the CVE [1].

Exploitation

An attacker must have valid credentials to authenticate with the rConfig web interface. Once authenticated, they send a GET request to ajaxArchiveFiles.php with a malicious path parameter containing shell metacharacters (e.g., semicolons or backticks). For example, a request like ajaxArchiveFiles.php?path=;id; will execute the id command. A public exploit script is available in reference [1].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands with the privileges of the web server process. This can lead to full system compromise, including data exfiltration, lateral movement, and potential persistence. The attack does not require any user interaction beyond authentication.

Mitigation

As of the publication date (2020-01-06), no official patch has been released by rConfig for version 3.9.3. Users are advised to restrict access to the affected endpoint, implement input validation via a web application firewall, or upgrade to a newer version if available [1]. At minimum, the exec() call should be replaced with safer alternatives and the path parameter should be strictly validated against an allowlist.