CVE-2021-21804

Vulnerability

A local file inclusion (LFI) vulnerability exists in the options.php script of Advantech R-SeeNet version 2.4.12 (20.10.2020). The script accepts the sub_opt parameter from an HTTP GET request and passes it directly into a PHP include() statement without any sanitization (line 218: include($sub_opt.".php");). This allows an attacker to control the included file, leading to arbitrary PHP code execution. The vulnerability is reachable without authentication, as the options.php script is accessible via the web interface.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the options.php script with a malicious sub_opt parameter. No authentication or prior access is required. The attacker can use path traversal sequences (e.g., ../../) or PHP wrappers (e.g., php://input) to include arbitrary files from the server or execute arbitrary PHP code. The CVSSv3 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high attack complexity, but successful exploitation does not require user interaction.

Impact

Successful exploitation allows an attacker to execute arbitrary PHP code on the target server. This can lead to full compromise of the affected system, including disclosure of sensitive data, modification of files, and denial of service. The attacker gains the ability to execute commands with the privileges of the web server user, potentially leading to complete control over the R-SeeNet application and underlying operating system.

Mitigation

As of the publication date (2021-07-16), no patch or workaround has been disclosed in the available references [1]. Users are advised to restrict network access to the R-SeeNet web interface, monitor vendor updates from Advantech, and consider applying the principle of least privilege to the web server process. If possible, disable or remove the options.php script until a fix is available.